[CriticalRegion]

No, you read it right. I just misunderstood the post's message as "these exploits will enable more supply chain attacks". I'll probably delete my comment since it's debating a strawman. It is absolutely right that these exploits might enable these attacks to have a larger impact. I still don't think that I agree with the message since a malicious npm package already installed can get its payloads from a C2 server, it doesn't need an npm update.

[Phelinofist]

> since a malicious npm package already installed can get its payloads from a C2 server, it doesn't need an npm update

In general I agree, but I think these two vulns are 0day-y and pretty much every major distro is affected AFAIU, so there is perhaps slightly more potential than usual

[asqueella]

Thanks for not deleting your question — I misunderstood the OP in the same way.