I don't appreciate a pedantic interpretation of the analogy; consider any marketplace where the sellers are not the platform: Amazon, FB Marketplace, Etsy, eBay, and so forth. When a consumer gets burned, who gets in trouble?
Github owns and controls NPM, npm is no longer a community-controlled project. Therefore, Github should [happily] take on the duties, responsibilities, and obligations of a software publisher to provide either: trust ratings on packages and code, or literally and not figuratively scan every single package-and-version on npm for appropriateness.
But obviously you already got that point and just wanted to exert some modicum of bossiness and control by having me regurgitate my well-formulated thoughts for a third time while painting inside the lines you insist are relevant.