There were. They're just not as popular here. For example https://www.sonatype.com/blog/malware-removed-from-maven-central https://www.sonatype.com/blog/malware

There were. They're just not as popular here. For example https://www.sonatype.com/blog/malware-removed-from-maven-central https://www.sonatype.com/blog/malware-removed-from-maven-cen... Maven is also a bit more complex than npm and had an issue in the system itself https://arxiv.org/html/2407.18760v4 https://arxiv.org/html/2407.18760v4