Still, how much they pay their developers a year? Would be over $150k I imagine, drop him $10k which he deserves and a sincere apology and we never would have seen this article, this would definitely cause a larger loss for them.
“The password hashes in this archived data were generated using PBKDF2 or salted SHA1 algorithms previously used by the npm registry. These weak hashing algorithms have not been used to store npm user passwords since the npm registry began using bcrypt in 2017. ”
What you see on that website is the cost, not the earnings though. If a private exploit costs $1.2k, you can get 5 digits by selling it 9 times. That isn't a huge number of sales, but I don't know if this exploit would sell that many times. Anyway, by disclosing on H1 you're "selling" at most once.
I was making something similar today to integrate into a dashboard, looks like I don’t need to anymore. This is very nice and well executed, thanks a million.
