Yes, I meant deb/rpm repositories. NPM is not a Linux repo, it's multipurpose, with lots of proprietary software.

It's the open part of it that's comparable to the app store in size. The closed part is in addition.

I agree there are linux-only repos that are ~1% of that size and contain little or no malware or abuse. That's true whether you measure size in updates per day or total count of packages, so 1% seems reachable without considerable malware problems.

> so 1% seems reachable without considerable malware problem

Another plausible explanation is that pure FLOSS repos are free fron malware.