GitHub owns and operates npm, so they certainly have the authority and ability to enforce it. I doubt requiring the same of packages hosted elsewhere is feasible.
Dependabot and GitHub already scan Ruby Gemfiles and lock files and .NET's NuGet package references, among others. They already have the raw data to do it for a number of package ecosystems (and you can see that on repo pages if you go look for it). Starting with npm is clearly obvious because they also own npm, but I wouldn't be surprised if they set similar bars for other package ecosystems that they are aware that they host critical supply chains for.