3 ms·

NPM isn't being singled out as part of a hypothetical risk analysis, this is about an attack that actually happened via NPM.