OP *is* the developer & maintainer of the affected packages, so the attacker was...

		handstitched 7 months ago \| parent \| context \| favorite \| on: NPM debug and chalk packages compromised OP is the developer & maintainer of the affected packages, so the attacker was able to use their phished credentials to upload compromised versions to NPM.

oh! understood. thanks.