[eranation]

These get detected almost immediately, and removed by npm within hours (axios, tanstack at least)

[Hackbraten]

But who will detect them on day one once everyone ignores them for seven days?

[bakkoting]

These things are usually caught by tools specifically scanning npm or by the maintainers noticing their account is compromised, not by people auditing their own installed packages.

[eranation]

There are some companies that specialize in detecting those, they do it for free (and get lots of marketing for it…)

[aoeusnth1]

AI agents