Given its popularity, it's easy to talk shit about npm, but rarely do people say anything actionable.
C++/boost could have a bad actor upload malicious code. The only difference is that people probably wouldn't notice for months, because everyone's running decades old versions of boost anyway. Not because they're mindful of security, but because nobody can bother to update it unless the need becomes dire.
Now, a favourite of mine (often preached by CPP Deva): if you're a good enough developer, you don't have these problems.
Were the npm problems avoidable? Yeah, if "yOu aRe a GoOd eNoUgH dEvElOpEr" and use lock files (generated by default) and only install from it (eg `npm ci` being the simplest method).
Disclaimer: I used to be an everyday npm user, and I'm not a fan of it by any metric, but the npm shit-slinging edgyness hype is so last year's trend. Jesus Christ.