3 ms·

Yeah that makes me wonder how many of such real bombs are quietly deployed in npm/maven setups all over the world...