Further follow up: I've updated the gist to include all packages between the time at which the first compromised package was uploaded and the time at which the

Further follow up: I've updated the gist to include all packages between the time at which the first compromised package was uploaded and the time at which the keys were invalidated (which was later than the invalidation threshold). I'm working on auditing the larger (~2000) list of packages now.