From 'Code Red' to 'Nothingburger': Was the NPM Exploit Overhyped?