Comment Comment by eranation These get detected almost immediately, and removed by npm within hours (axios, tanstack at least) parent eranation 5 months ago