Day 37 10 min
npm left-pad 2016: the unpublished package that broke builds
1 / 13 · ≈ 7 min left
Warm-up
From yesterday. Answer from memory: a wrong guess still helps you remember.
event-stream 3.3.6 was published on 9 September 2018 with "flatmap-stream": "^0.1.0". How did apps get the malicious 0.1.1?