[nighthawk454]

Yes, that is totally true. That's kinda what I was going for putting 'leaked' in quotes. It's not really leaked because the data is technically public. You can of course scrape it from say: https://registry.npmjs.org/react

However, it's been made significantly more accessible in a tool like this. NPM doesn't list it prominently in their UI anywhere (I believe).

So the 'leak' is up-publicizing data outside of the control of the owner, and when other, intentional (and likely better) alternatives exist.