Why should MS buy any of these startups when a developer (not any automated tech) found the malware? It looks like these startups did after-the-fact analysis for PR.
MS doesn't care
Are you sure about this? Would love to see which ones.
The dev later said that Charlie notifying him probably shaved off some very important time for the remediation.
So in this case 2 different companies found it using automated tech before anyone else
There's no reason why Microsoft/npm can't do what we're doing, or any of the other handful to dozen companies that do similar things to us, to protect the supply chain.