I think you misunderstand the role of NPM in this concept. Using NPM ensures that web sites distribute the code to their users. So it doesn't matter if there's

I think you misunderstand the role of NPM in this concept. Using NPM ensures that web sites distribute the code to their users. So it doesn't matter if there's only a few hits using NPM, if they are good hits. As the article mentions, neither Amazon nor eBay are protecting against this. If they somehow added the package to their app, that provides access to every credit card added to those sites. That is much broader than user's installing Chrome extensions.