Given that it's making calls to histats.com and statcounter.com, I wouldn't be surprised if this is someone trying to make a point. Let's hope so, at least :) I would be interested in a blog post detailing how many credentials they were able to obtain, how many people they managed to infect and how many packages they could potentially compromise.
If npm (and I'm guessing they will) have to invalidate all publish tokens for all users, that is going to be painful.
Edit: I should point out that this is just speculating - there are definitely still ways this could be abused, so don't assume you're safe.
If npm (and I'm guessing they will) have to invalidate all publish tokens for all users, that is going to be painful.
Edit: I should point out that this is just speculating - there are definitely still ways this could be abused, so don't assume you're safe.