I think part of the difference at issue is the number of distinct entities (users/organizations) you need to trust due to the acceptance of micropackaging. Wit

I think part of the difference at issue is the number of distinct entities (users/organizations) you need to trust due to the acceptance of micropackaging. With most programming languages, a small-to-medium project might pull dependencies from tens of entities, but with npm, even a small project can easily rely on hundreds or even thousands of entities. It is easier to weed out unreputable entities when you are depending on fewer entities.