npm is finally going to disable postinstall scripts by default in the next major version at least, copying what other JS package managers like pnpm do. They also added a setting for minimum age (only install package versions that are at least X days old) which is meant to help too - the idea being that malware will have been detected and removed before anyone installs it.

People use third-party Linux package repos all the time though, and they have similar attack vectors. If I can convince you to add my Debian/RPM/whatever repo, I can create a package with the same name as a common one but with a newer version number, and apt upgrade will happily replace the official package with my malicious one.

This is intentional for several reasons (e.g. deb.sury.org has PHP packages that replace the official Debian ones) but I'm really surprised we don't see more supply chain attacks via third party deb/rpm repos.

Maybe it's because the barrier to entry is higher? With a custom deb repo (either self-hosted or using something like Packagecloud or Ubuntu PPA), you need to create the repo, create Debian packages, add them to the repo (eg using Aptly), GPG sign the repo, and convince people to add the repo. npm is just one repo with everything in it.