System package managers typically have a significantly stronger trust model — the packages are built and signed by a “trusted” entity who typically takes on a role in verifying that the packages they sign and distribute meet some standard of sanity.

npm gathers sources from a central registry which anyone can upload packages to — and furthermore package references don’t even have to be references to entities in the registry but can also be links to arbitrary git repos ...

Furthermore the set of dependencies to actually be downloaded is quite a bit more dynamic with npm I think because of the version compatability satisfaction algorithm employed by npm — so it’s inherently harder to statically analyze the set of packages a given npm install execution will install vs rpm/apt.