My guess is that it's a two-tier process. For one, in many ways, NPM packages are kind-of winner takes all type of a setup where a narrow circle of packages acc

My guess is that it's a two-tier process. For one, in many ways, NPM packages are kind-of winner takes all type of a setup where a narrow circle of packages accounts for most of the installs. This leads to more eyes on them, but I would say this is secondary to the following point. Most of the time, when a package is either added or updated, someone technical, usually a developer, is staring at their terminal, browser dev tools, and/or dozens of other things. If something fishy was aloof, the chances of it being noticed are considerably higher than in a regular user-computer interaction. Add automated scanning employed by Github, NPM and others to the mix, and I'd say that's the answer. Clearly it can happen since it has, but every time it does happen, the space for shenanigans grows narrower.