build1 distinct publisher
Shai-Hulud spreads by bumping a version number your dependency range already accepts
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Publishers:thenewstack.io
Reality
- Evidence38
- Adoption42
- Hype gap+16
- Incentives48