They only found these malwares because the malware part was at the top level. Who knows how many are there that hide this logic in an npm dependency.