If I understand the npm incident report correctly, the answer is none: > We determined that access tokens for approximately 4,500 accounts could have been obta

If I understand the npm incident report correctly, the answer is none: > We determined that access tokens for approximately 4,500 accounts could have been obtained before we acted to close this vulnerability. However, we have not found evidence that any tokens were actually obtained or used to access any npmjs.com account during this window. Source: https://blog.npmjs.org/post/175824896885/incident-report-npm-inc-operations-incident-of https://blog.npmjs.org/post/175824896885/incident-report-npm...