> When people install npm packages, they typically only install ones the community trusts.

This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance.

As others pointed out, the default install for many modern web dev frameworks includes hundreds of dependencies.