It's a fair question, most JS libraries I've discovered weren't directly accessed with Google -> npmjs.com but instead from the library's own page, GitHub, Hacker News, etc.

If I Google a library and end up on npmjs.com I usually just click on a link to the library's repository or home page first.

Of course, it would disenfranchise a bit, but what is another option?

Not npmjs.org's problem. Most languages their dependency managers don't give away indexed flashy web pages for free either, yet discoverability is usually not a problem.

Which languages have dependency managers with a public registry that is not indexed in Google? pypi.org and docs.rs are both indexed in Google, for example. With docs.rs it's even kind of annoying because often the indexed page is for an outdated version of the package.

There's really no reason why the same spammer couldn't target those sites too.