The comment you replied to meant never submitted for publishing.

>They cut and submitted a compromised release to npm; npm just happened to block the publishing.

The point is that this is incorrect. A compromised release was not submitted to npm. It didn't make it beyond the git repo.