- Linux is more ubiquitous than Node.js. If somebody exploits Linux, they get at least one order of magnitude more machines. So there is a higher motivation.

- Funny code in C is harder to spot than in Javascript. Furthermore ...

- A binary is harder to inspect than any module written in Javascript (even if minified).

- The code in the Linux default installation has at least 2 orders of magnitudes of the code that yarn installs.

I was very conservative in my estimations.

Considering these kind of attacks, Linux seems more likely to be already exploited by a few organizations in multiple ways.

We have been trusting too much. As more code gets written and many more people come to learn to program, the number of supply chain attacks will increase. And at the same time, as the security know-how is easier to be accessed on the Internet, we will get smarter exploiters capable of hiding their wrong doing.