Debian has ~20,000-30,000 packages total. NPM has well over a million. Contribution frequency and overall contributor numbers are also much much higher.

NPM is a victim of ease of use and popularity. It's a bigger target.

But both systems would benefit from a holistic approach to supply chain security.