Something that I feel is missing – someone please let me know if I missed it – is how long this bug was materially present in packages? how many people likely were exposed to it?