I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each

I think it's worth pointing out that these pull requests replace a totally unrelated package with either one of these two packages that claim to be copying each other. The way it was framed was that someone forked a packaged and started replacing all users; not what happened. Also: I don't even use JS, so, I have no idea who these people or libraries are.