Fair. NPM is the part I actually distrust.

That said, I'm not sure it's necessary to make a distinction. I can't imagine many teams are using NodeJS (particularly with React or the like) without buying into the package ecosystem.