I'm not talking about npm. I'm talking about the 3.1 million libraries hosted on npm. And the ~150k libraries available in rust's cargo, 187k ruby gems, 667k pip packages, and so on. For every React ("brought to you by facebook") there are thousands of tiny projects made for free by volunteers.

I have some there, two of them made on the clock on the job. For others I am 100% ok with them being used in the scope of the license. I would find it incredibly absurd if someone called users "leeches" for using these things.