The most dangerous NPM breach in History

Is this up to date? How are there still active packages with the payload?