No, the risk is very, very different. debs used in the official Debian repository are the result of a process that requires authorized developers who have been

No, the risk is very, very different. debs used in the official Debian repository are the result of a process that requires authorized developers who have been nontrivially vetted (including establishing their real-world identity) to cryptographically sign the packages with their own keys, before they are signed with the repository key. The packages also follow a strict release process that affords opportunity for malfeasance to be detected, especially in popular packages. You have a good assurance that the package is not malicious, and that if it is, someone will be accountable. npm, pypi, and rubygems do not follow such a process. Pretty much anyone can add a package to them which might do anything.