VerifiablyMrWonka

For an organisation hosting as many companies data as this one I’d expect automated tape at a minimum. Of course, if the attacker had the time to start messing with the tape that’s lost as well but it’s unlikely.

Not to mention that the defacto package manager (composer) blows NPM out of the water in basically all metrics. From what I understand most languages package managers now look up to or even model themselves on it.