Why would malware authors target NPM in particular? Maybe they are targeting lots of package registries, and NPM is just more vigilant?