TBH I think its not because JS somehow fundamentally attracts a different group of people, its probably more like: - It being web based means you can target th

TBH I think its not because JS somehow fundamentally attracts a different group of people, its probably more like: - It being web based means you can target this kind of software for maximum "impact" - NPM dep trees are massive and you generally have thousands of tiny libs. The chance of something like this happening and being noticed goes up therefore. - NPM ecosystem is a bit more wild west which again leads to increased chance of something like this being able to occur in the first place.