npm's worms ride a few big accounts, not your dependencies

I counted who published every package in npm's six worm outbreaks. Most came down to a handful of big accounts, and hardly any spread down the dependency tree.