“Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.”
Any account could push a new version of any npm package. One service checked permissions on the URL and another trusted the request body. GitHub says it saw no abuse, but its logs only go back to September 2020. The bug is older than that. Nobody can say what shipped before the telemetry started.