Comment by justicz

I didn't mention it in the post, but npm was patched up before the update was publicly released. The CouchDB team coordinated with some of the bigger customers in advance (I also specifically requested that they do this in my original bug report).