You're totally right, it's just as bad, maybe even worse because build tools sometimes ask for admin permissions. People should ideally really on some kind of reputation system or get software from trusted vendors.
All of these, along with those package managers have had malware posted to them.