I'd be curious to learn what kinds of safeguards various package managers of Linux distros have employed against supply chain attacks on individual maintainers

I'd be curious to learn what kinds of safeguards various package managers of Linux distros have employed against supply chain attacks on individual maintainers who might try to poison certain popular packages if compromised? Specifically, I'd imagine NPM might actually be a bit better than many distro's package repos due to the post left-pad era changes they put in place to make packages more... immutable and tamper-resistant, so the only way for a new malicious package to reach users is for those users to actually explicitly update to the new malicious versions. But being not even remotely familiar with how Linux package repos are updated/maintained, I'm probably missing a lot of nuance.