> Since then, the npm security team has removed all the compromised coa and rc versions to prevent developers from accidentally infecting themselves.

Removing all trace of evidence is not something "security teams" should do. Instead of sweeping security incidents under the rug (where twitterverse resides), they should at least mention the existence of these versions and that they contain malware on the package page.