I think the net amount of code ends up being pretty much the same, it's just spread over several repositories/sources/owners. That does mean it's more difficult without tooling to trawl through, but it's not like it's an order of magnitude or anything.
The interesting part is how professional the packages are handled. For example in JavaScript there a thousand of authors with very different understanding of their "responsibility". Some do not even provide a license (do not even care to put a "WTFPL" or "Unlicense" on it) and do not read bugs. Others, have a emergency response team and publish CVE records. The less packages I have, the better I can select them and monitor them.
Java/.NET/Python ecosystems tend to be more professional with this regards. JavaScript catches up but is not completely there yet (you can see this with the amount of repositories who add licenses in 2016/2017 timeframe, years after creation).
Hence, same amount of code, much more work (it is a magnitude).
