At peak, the 418 responses were 0.01% of traffic. npm has a great many users (over 10M), so given traffic over the time of the incident that works out to between 500 and 1000 actual users affected ...

NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data. These 4 packages had collected over 1,000 total ...