> The requirement `1.0.107` is a caret range, and with only `1.0.106` and `1.0.107` ever published it resolves to the malicious `1.0.107`.

Uhh no it isn't? This seems to be a pretty low quality article