[z3t4]

npmjs.org is a joke at this point. I guess their support is run by LLM because you can just write to them and they will transfer ownership of any module nilly willy.

[tobyhinloopen]

That’s a bold claim to randomly write without any supporting sources

[z3t4]

I've got an example and submitted it via bug bounty channel, but they classified it as "social engineering".