A highly relevant study: "Small World with High Risks: A Study of Security Threats in the npm Ecosystem" https://www.usenix.org/conference/usenixsecurity19/pr

A highly relevant study: "Small World with High Risks: A Study of Security Threats in the npm Ecosystem" https://www.usenix.org/conference/usenixsecurity19/presentation/zimmerman https://www.usenix.org/conference/usenixsecurity19/presentat... The paper is full of hard data.