NPM debug and chalk packages compromised

Also because Java, .NET, etc. all have very expansive standard libraries. You don't need to import most stuff, as it's already built-in.

Very true... I'm more experienced with .Net, but usually when you bring in something, it's much more of a compositional library or framework for doing something... like a testing harness (XUnit), web framework (FastEndpoints), etc. No so much in terms of basic utilities, where the std library and extensions for LINQ cover a lot of ground, even if you aren't using LINQ expressions themselves.

I mean, Apache Commons are still widely used. But it's just a handful of libraries maintaned by one organisation.

But then you depend on Microsoft for everything. I prefer python where it's battery Included but you depend on a foundation

Hasn't .net been open-source for like 10 years?

It is, but it's still firmly controlled by Microsoft, particularly when it comes to ecosystem evolution. Some people find that uncomfortable even if the source is open - legal right to fork is one thing, technical ability to do so and maintain said fork is another.

But most of the documentation and tooling is around visual studio and azure