An exposure metric measures how widely a suspicious or malicious package was downloaded. It is a useful signal, but it does not prove how many unique systems were compromised. One download may come from a developer laptop, a CI runner, a mirror, an automated scanner, or a repeated install of the same package.
In cyber security, this distinction matters because defenders must avoid treating download counts as victim counts. A package with a high exposure metric may deserve urgent review because it had many opportunities to execute through install-time scripts or dependency chains. Security teams use the metric to prioritize hunting across endpoints, build systems, and caches, then confirm actual compromise with logs, process traces, and credential rotation. In short, exposure shows reach; investigation shows impact.