I'd wager it primarily is due to market share. Why infect .001% of the Node.js community when you could infect .0001% of the PHP community. Given that its a n

I'd wager it primarily is due to market share. Why infect .001% of the Node.js community when you could infect .0001% of the PHP community. Given that its a newer language, its likely that node.js users are more technically skilled. Few people learn node.js as their first language. In PHP for instance, we've all seen code online from novices with horrible SQL injections (...a $_GET or $_POST directly in the query). Node.js has a lot less legacy code. (E.g. Linux has 1000s of exploits over the years, if left unpatched you're in for a bad day).