https://github.com/nodejs/node-gyp/blob/master/package.json#L14

https://www.npmjs.com/package/node-gyp

Expected: 4.0.0 is published to npm
hm, https://github.com/nodejs/node-gyp/commit/75cfae290fee1791a23fa68820ae5dd841e93e14
The bump to v4.0.0 happened 2 years ago, but 4.0.0 was never published to npm.
I have no idea what is happening with releasing of this package, can someone explain this mystery?
this issue results into node-gyp being vulnerable:

Related to https://github.com/nodejs/node-gyp/issues/1717
cc @nodejs/node-gyp
@limonte , this situation will be remedied?
@shehi I'm not the maintainer of this package. 2 years wasn't enough to run npm publish so I'd assume we'll need to wait a few more years.
I think this is now fixed per https://github.com/nodejs/node-gyp/pull/1718#issuecomment-486023253 (thanks, @rvagg!).
Closing this now, feel free to reopen and/or comment though.
$ npm i node-gyp
+ [email protected]
added 100 packages from 67 contributors and audited 156 packages in 5.265s
found 0 vulnerabilities
Most helpful comment
@shehi I'm not the maintainer of this package. 2 years wasn't enough to run
npm publishso I'd assume we'll need to wait a few more years.