I'm even more cynical than your are here. I think the likelihood of this being the first time a credential-stuffing attack has worked against an npm account is

I'm even more cynical than your are here. I think the likelihood of this being the first time a credential-stuffing attack has worked against an npm account is vanishingly small. While the timeline given makes the response time sound good - it still took a user notification 90 minutes after the first signs they've found so far of the attack to start kicking in the response. I wonder how many npm packages are widely used but under _way_ less scrutiny than eslint? Memories of the leftpad.js debacle make me suspect the attacker was not nearly as evil as possible - if they'd chosen a package that lives way down in the dependancy tree of a bunch of popular stuff, but which itself is unlikely to get much scrutiny, this attack might have slid under the radar for a lot longer. (And I've no confidence that this hasn't already happened, possibly multiple times, and this was just a copycat attacker who got "greedy" and foolishly dropped his attack payload onto a popular and heavily scrutinised package...)