Following the compromise of an ESLint maintainer’s account last week, malicious packages that attempted to steal login tokens from the npm software registry were published without authorization.
http://feedproxy.google.com/~r/Securityweek/~3/rriGWh3S1NQ/malicious-eslint-packages-steal-software-registry-login-tokens
