When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm Install

The concrete problem A package is reported compromised. Your security channel immediately fills with one question: did we ship it? Looking at the repository’s current dependency tree is not enough. Th...