I honestly have no idea where NPM pulls its audit numbers from. If I open up npmjs.com right now, it says there's 1,153,926 packages in total on NPM. While CRA does have a bunch of transitive dependencies, I can guarantee that CRA does _not_ depend on 83% of the entire NPM registry :)