Comment by Sahhaese

I see it's been fixed by releasing 6.9.2.

Does this mean you can now "brick" people's projects by sneaking [email protected] into their package.json?