Thank you for your service!
Now this part is quite concerning though:
"I tried sending an email to security@npmjs and got a bounce back. Tried submitting to their security portal and got an error. I tweeted out in desperation to get a hold of a human."
