You might be interested in GitHub's State of the Octoverse report from 2020 that had a section dedicated to security of popular languages, active open source projects on GH with those languages, and the package managers for those platforms.

https://octoverse.github.com/2020/

Microsoft's security record. Not one package manager.

https://arstechnica.com/security/2024/01/microsoft-network-b...