I'd say npm itself probably use npm packages internally? What if they were already compromised through this flaw to avoid these red flags from popping up? The

I'd say npm itself probably use npm packages internally? What if they were already compromised through this flaw to avoid these red flags from popping up? The attacker might be monitoring their logs, selectively silencing version clashes. Heck, it's even possible they now have backdoor access to do whatever they want to any package. I know it's cynical thinking, but this vulnerability was unbelievable and the way they're handling is definitely not reassuring, from my personal standpoint.