Security researcher found ~0.2% of npm users re-used leaked passwords for npm