For instance, when adding a new dependency package using shell:
npm install typescript
I have no knowledge of the provider behind that package.
In contrast, in Maven (a Java package manager), you add a new dependency package by modifying the xml configuration file:
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.1-jre</version>
</dependency>
At least, I am aware that the provider is connected to the domain owner of "google.com".