npm is now a private company right? It does also look like they have already gone through enshittification and don't even seem to have publicly acknowledged this attack.