Malware in Debug (npm)

ouch. So... debug has 55k+ packages dependent on it. Is this a real vulnerability or did someone figure out how to spoof the github advisory database?