Glad to see someone else identify the anxiety at the root of the culture.

After an npm incident in 2020 I wrote up my thoughts. I argue that this anxiety is actually somewhat unique to JS which is why we don't see a similar culture in other languages ecosystems

https://crabmusket.net/java-scripts-ecosystem-is-uniquely-pa...

Basically, the sources of paranoia in the ecosystem are

1. Weak dynamic typing

2. Runtime (browser engineers) diversity and compatibility issues

3. Bundle size (the "physics" of code on a website)

In combination these three things have made JS's ecosystem really psychologically reliant on other people's code.