Are you being serious?

https://www.cpomagazine.com/cyber-security/open-source-devel...

https://therecord.media/malware-found-in-npm-package-with-mi...

...

and the list goes on

You can even use npm to manage and publish Python code, or could a few years ago if they haven't added constraints on the registry since then