I've been monitoring NPMJS for a few months now. Up until Feb 28th they had a very close handle on these packages and removed them in around 8 hours. We're seeing these packages stay online for a lot longer now (and the volume is much higher)