No confusion here. Node.js is an entire ecosystem, and npm is a child of that mess. It is absolutely famous for the massive gobs of absolutely junk it pulls in to satisfy dependencies a frontend dev could manage with 4 lines of native js.
You may rail on about how npm != node, but everyone considers npm to be 'node package manager', no matter what the initialism actually stands for.