In my (non-expert) opinion, there are a few reasons
- NPM is more popular than those other services by an order of magnitude, especially among new developer and startups.
- NPM allows for code to be executed while you install the package which is different from maven or nuget and allows for easy exploitation paths
And then, because you were never in a classroom and never took a class on security, you probably have no idea what a buffer overflow attack is or how to use tools like valgrind to check for them.
Then you put your C code on the internet and get your server pwned inside of an hour.
Slightly hyperbolic? Yes definitely. But there is a reason we don't teach C to beginners anymore. Generally you want them to understand the mindset of coding before throwing them in the deep end. And I would bet nothing has caused more people to quit programming then
Segmentation fault: core dumped