As for the numbers: see 39 mins into https://youtu.be/jWujI7Hk8O4
I used to work at npm as the SRE manager right before the acquisition and the ballpark figures make sense to me.
Had a second to sit down, and I _way_ overestimated my counts.
Per NPM there are 2,480,373 packages. According to Whitesource [1] there are an average of 12.3 versions per package. This gives us a total of 30,508,587.9 archives to scan. At a cost of $1B to scan that means each package would cost $33.959…
There’s no way that’s reality. That seems like several orders of magnitude too high.
1. https://threatpost.com/malicious-npm-packages-web-apps/17813...