Comment by jtsiskin

Do they? Their website https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository."

Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695

If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see

-rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak

-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh

both which just have the contents "Retesting"