> npm packages

This has nothing to do with what I said. npm is not a trusted or a FLOSS repository.

> we don't live in fairyland

When did you see a malware in Debian's repositories last time?