It's not completely resolved until everybody who was potentially compromised audits everything their credentials gave them control over and changes the credentials.
Is a bug not fully resolved until every machine on the planet running that software has upgraded to a version in which the bug doesn't exist? That'd be quite a silly assertion imho.
I mean sure, the turn-around time is great...but how did this pass review in the first place? This should never happen in a reasonably managed project.
It wasn't up for review. It was published out of band, and outside of the ESLint pipeline using likely stolen credentials. That's how that stuff sneaks in.
Ah, thanks for the clarification. At first I thought this made it through the actual release process.