Nice disclosure, and can't fault the npmjs team given that they commissioned a security audit as soon as they possibly could.

I wonder if the npm, Inc. team told ^Lift about the disclosed vulns before ^Lift's own audit completed. I can imagine being tempted to see whether they'd discover it themselves, to gain more evidence on how comprehensive the audit was.