Edit: when using WebPack you should use NPM-packages (with a lot of their dependencies and sub-dependencies), but in "classic" websites you usually download 3rd party libraries from official sites, and update them only when you really need, which seems to be much more secure
The problem is independent of what technique you use to obtain your JS libraries. It doesn't matter if you use NPM packages, web-pack or manually copy&paste a folder of .js files. The problem is with using 3rd party code from untrustworthy sources and putting them into your web application without making sure they don't contain any malicious functionality.
When you decide to use 3rd party libraries in your web application, make sure that:
- It's a trustworthy project with a good reputation. Is jQuery trustworthy? Is Angular trustworthy? Is PhilippsSuperReliableCreditCardValidator.js trustworthy? Which projects seem trustworthy to you and which don't is a decision you need to make for yourself.
- You download the files from the official server via an authenticated and encrypted connection (which tool you use for that purpose is secondary)
- You keep the copies of the libraries on your own server. Don't download libraries from an offsite source on page-load.