> Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. No, it pulls the specified version. The affected packag

> Yes, they did. Have you read the article ? That's how npm works: it always pulls the latest version. No, it pulls the specified version. The affected packages fixed it by removing the leading carpet in the version specifier, which was designed to allow patch version bumps for things like security fixes. He literally abused the versioning system designed to allow security fixes by introducing a breakage and disguising it as a non-breaking change.