In a supply chain attack, attackers injected malware into NPM packages with over 2.6 billion weekly downloads after ...

At peak, the 418 responses were 0.01% of traffic. npm has a great many users (over 10M), so given traffic over the time of the incident that works out to between 500 and 1000 actual users affected ...