Research1 in 10 popular npm releases needed a hotfix