GitHub announced this a while back:

https://github.blog/changelog/2026-07-28-npm-publish-time-ma...

"A while back" -- One week ago.

I am curious if they are still implementing the process or if this particular attacker already figured out a way around it.

Ah, I see your problem there

> This requirement will be progressively enforced over time.