Orion is the core behind all of the modules (like NPM & SAM). The hotfix for the vulnerability is on Orion core, therefore the hotfix numbers would not update for NPM or SAM. You should see an updated Orion HF number at the bottom of any Orion web page once upgraded.
Check the security advisory page for updates as well as the FAQ. There is also a video here which may be of assistance.