It claims a release was sent to NPM, and this is not true. The maintainer of Zod made sure even this kind of attack could not proceed with a publication. The comment I answered to is dismissing these efforts put in place by Colin.

The comment you replied to meant never submitted for publishing.

>They cut and submitted a compromised release to npm; npm just happened to block the publishing.

The point is that this is incorrect. A compromised release was not submitted to npm. It didn't make it beyond the git repo.