> NPM isn't inherently different from, say, Debian repositories, except the latter have oversight and stewardship and scrutiny.

Which when compared to NPM, which has no meaningful controls of any sort, is an enormous difference.