How GitHub could secure npm

Why doesn't npm detect compromised packages the way credit card companies detect fraud?