yes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already ap

yes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )