Create React App is pretty popular and it has 36k dependencies. That’s not saying everyone using it ships every one of those but that’s definitely a LOT of people who could potentially introduce malware, often with a fair chance of it being deniable.
With a dependency forest that large, it's small wonder that not more JS projects aren't compromised by bad dependencies...