I got the news via https://safedep.io/keyv-npm-supply-chain-compromise/