> That means every single package published between the vulnerable packages and the mass token invalidation is suspect and should be unpublished until it can be audited.
I wonder how many packages in fact got published during that nine-hour time window. Does anyone know what kind of number that would be?
I'm currently dumping the npm db right now to figure that out.
eslint-scope 3.7.2 was published on 2018-07-12T10:40:00.478Z
eslint-config-eslint 5.0.2 was published on 2018-07-12T09:49:24.957Z
tokens were invalidated at 2018-07-12 12:30 UTC
I'm reading it as tokens created before 2018-07-12 12:30 UTC were invalidated, but the invalidation itself happened on 2018-07-12 18:42 UTC according to eslint's post-mortem[1]. I think the latter is the more relevant date.
If I understand the npm incident report correctly, the answer is none:
> We determined that access tokens for approximately 4,500 accounts could have been obtained before we acted to close this vulnerability. However, we have not found evidence that any tokens were actually obtained or used to access any npmjs.com account during this window.
The wording is pretty vague, I guess intentionally, but saying "we found no evidence..." isn't as confidence-inspiring as if they'd said "we determined that no...".
I wonder how many packages in fact got published during that nine-hour time window. Does anyone know what kind of number that would be?