why node.js makes me uncomfortable

You don’t have to use modules, you could always implement the functionality yourself instead, the same way you would with php

Node just doesn't have as many batteries included as PHP does. Sometimes that means PHP is easier to use, other times it's much harder.

If you need to do something that isn't in the built in libraries in PHP, now you're installing packages just like in node. In my experience having worked a lot in both, in bigger projects you'll be using a lot of third party packages in either language. That being said, I think Node has a bigger, richer ecosystem of packages to choose from.

Programmers who don't use pre-made modules make me uncomfortable. You'd have to spend a lot of time to get a good, well-written and fully test-covered implementation of most things to work - copying functions from PHP documentation comments pretty much guarantees some issues that you don't know about.

Of course you have to vet your dependencies, but e.g. Symphony modules in PHP are pretty good, no reason to write a worse version yourself.

my biggest fear in all this is the malware spreading around :/

You never used Composer or the like and always built on bare code base? You never used libraries?

You can develop like that with nodejs and bun.sh as well. It's just quite tedious just like in php.

You've never had to do something outside of what is included in the PHP standard library? You've never used composer or included a third-party library?

You must dedicate a lot of time to writing things from scratch, things that are already solved (almost certainly better than you or I can ever do ourselves) and can be utilised by using a third-party library / module / package etc.

Node does take things to the extreme sometimes, but often packages are saving you hundred or thousands of hours a year, so you can focus on overall logic rather than creating an already existing tool for sending high-volume templated email, for example.