npm audit Won't Save You in the First Hour of a Supply-Chain Alert

When the ua-parser-js maintainer's npm token was stolen in October 2021, the poisoned release sat live for about four hours. npm audit reported zero vulnerabilities during those four hours, for a pack...