At peak, the 418 responses were 0.01% of traffic. npm has a great many users (over 10M), so given traffic over the time of the incident that works out to between 500 and 1000 actual users affected ...