[igregoryca]

The baffling part is why it takes hours for the npm security team to unpublish packages that contain malware, as attested by multiple independent sources? That should be able to happen in minutes.

[linkregister]

It would take longer than minutes to validate the claims themselves.

[consumer451]

Who vets the sources, and using what scheme?

[tomjen3]

If email matches owner of repo, pull now. If not verified, ban and restore later.