Also reported here: https://socket.dev/blog/npm-author-qix-compromised-in-major-...