Is there any meaningful difference between what google knows about your modules and what npm knows about js modules? Or what a Debian mirror operator knows about your packages?

I get that Google changed the way go packages work, but I don't understand the difference between that and literally every package manager in existence.