If it's referring to what I think it is, part of this is my fault and I feel I should give a post-mortem as well. There was a problem with marked (the markdown

If it's referring to what I think it is, part of this is my fault and I feel I should give a post-mortem as well. There was a problem with marked (the markdown parser npmjs.org uses for READMEs) which allowed users to provide `javascript:` pseudo-protocol links even when the `sanitize` option was enabled. It was fixed[1] with marked v0.3.1 on jan. 31st. It looks like npm-www started using marked v0.3.1 on feb. 17th[2]. [1] https://github.com/chjj/marked/commit/904c71b7713979b01d5bc5264c2808c73fef99a7 https://github.com/chjj/marked/commit/904c71b7713979b01d5bc5... [2] https://github.com/npm/npm-www/commit/a1ed923870609b578fcde4d0d36f35a484e7b379 https://github.com/npm/npm-www/commit/a1ed923870609b578fcde4... edit: On closer inspection it looks like it may have been a problem with the html sanitizer[3] it used as opposed to the marked `sanitize` option (which is not used at all). I guess my conscience is clear here at least. [3] https://github.com/npm/npm-www/blob/master/models/package.js#L114 https://github.com/npm/npm-www/blob/master/models/package.js...