Note that for the leftpad incident, the impact was build faillures, not remote code execution.