Related:

NPM debug and chalk packages compromised

https://news.ycombinator.com/item?id=45169657