Node.js Dublin: NPM vulnerability management: Anatomy of the flatmap-stream incident