Part of me wonders if the reason we see more npm attacks than pypi attacks is malware authors not wanting to deal with python packaging either