The chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... I believe socket also found it this way just a bit later.

The dev later said that Charlie notifying him probably shaved off some very important time for the remediation.

So in this case 2 different companies found it using automated tech before anyone else