Post

I'm building an example repo to show off some stuff. Part of it is publishing it to npm...and it started getting downloads 👀. I didn't download it.. Guess I should update the README to explicitly mention this is just a DEMO

These are pretty much all scanning tools (both white hat and probably black hat) that download every package version to run analysis for eg. Vulnerabilities. It's akin to bringing a HTTP server online and instantly getting hits to /wp-admin.php