I mean npm only has slightly more than 1 million packages, last I checked.

This doesn't make even the slightest bit of sense. Did somebody somehow just import... everything by accident? Did npm hit a bug? Is there some infinite recursion going on that eventually hits a wall?

This obviously isn't representative.