Why is NPM so consistently awful? It seems like there's a new scandal every year, whether it's packages getting hijacked, packages getting broken, fundamental p

Why is NPM so consistently awful? It seems like there's a new scandal every year, whether it's packages getting hijacked, packages getting broken, fundamental parts of the system not working... If I trawl through my own comments I can find several discussions of similar mishaps and problems. Package management is hard, but you don't hear about pacman or pypi or RubyGems or NuGet having these kinds of problems. What gives?