JS developers are typically less experienced, less qualified developers who tend not to know all the ways you can be exploited by software from a 3rd party.
A very simple example of this is that almost all who use NPM have their builds configured to use the very latest version of each dependency, which means they have no idea what code is actually used each build.
This practice is encouraged by the community, and it takes extra effort to pin versions. This is pretty basic engineering stupidity, but its the NPM way.
Then th ey usually build their app each time it starts. It's not recompile, it goes and pulls down the dependency, whatever the latest version is ... each time it runs.
So even if it was built and 'released' with version X of its dependency, it could restart with X.1, or same version number, but hacked version upstream ( this has literally happened multiple times over the years ) because there is no validation.
Then, the "language" is so broken and non-standard there are dependencies for some silly shit, like parsing tabs correctly, and so each dependency you pull in, it may have a dependency tree of another hundred things.
The end result is pulling in even though basic things, you pull in hundreds of other dependencies. All of them set to then pull the latest version of child dependencies without any sort of validation.
NPM is used by a bunch of immature developers who lack the experience to understand that pretty much everything they consider a feature of the language is in fact a flaw that other languages/ecosystems dont allow for or highly discourage.
JS/NODE/NPM are designed around and encourage anti-patterns the rest of us stopped doing years ago.