notes ·verdict is per service, highest across its lockfiles. unscanned means the service resolves an affected version but its source was not read — not that it is clean.

Membership is exact (RESOLVED = the lockfile's flattened install tree). Explanation paths are the 3 shortest per lockfile, not all of them.

notes ·live_to is an upper bound: npm publishes no takedown time; we use min(next surviving publish, advisory published).

notes ·live_from is exact (npm keeps the publish timestamp after erasing the version). live_to is an upper bound where marked — npm publishes no takedown time.

in_window: the pin was committed while the artifact was installable; it does not prove an install happened. pinned_removed: the lockfile pins a version npm has erased, which is only possible while it was live — commit time is irrelevant.

limits ·past the computed cap the reach cell reads “— not computed” — never a 0.

49 co-maintained packages; exposure computed for the 12 most downloaded.

twofa / account_created are not exposed by the public npm registry; shown as unknown, never guessed.

'services at risk' = services resolving the co-maintained package today — the exposure IF that package is compromised next, not exposure to this incident.

notes ·The corpus is packages present in the ingested graph, so near-neighbours may be legitimate look-alikes; distance and kind are facts, 'typosquat' is a hypothesis.

notes ·0 services · 0 lockfile snapshots · 49 co-maintained packages · composed in 4.59 s