> In npm we at least know that a package is immutable once published, someone could publish a malicious version as a newer release but a current release.

This is only true as long as you trust NPM. If they were hacked or taken over by a malicious actor, packages could be modified unbeknownst to you.