Some tiny subset of those many eyes might have found it, but by then its impact was far from shallow. In some open-source ecosystems (e.g. GNU or BSD) the ratio

Some tiny subset of those many eyes might have found it, but by then its impact was far from shallow. In some open-source ecosystems (e.g. GNU or BSD) the ratio of useful eyeballs to vulnerable ones is much higher. It almost seems to be a goal of NPM to maximize the blast radius before a problem is noticed. That's not a healthy way to manage open-source projects.