nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7yf7cxzxz4kwf24zmflvyqqtrylsjwm5q9a074u5ger57rmzz0aqe544dh looks like npm delisted the vulnerable versions quickly...
@nprofile1q... Yep, and the staged malware dependency. No longer an active threat, but a hunting project. It's such a pain that this can hit a CI/CD pipeline if it runs at the wrong time.
1