I think the important part is that it’s a package manager commonly used for front end development, so the malicious code runs directly in the browser. It could

I think the important part is that it’s a package manager commonly used for front end development, so the malicious code runs directly in the browser. It could have been bower or something else but npm is the probably the most popular choice these days.