Someone added a virus to an npm-package, which tries to steal npm credentials:
https://twitter.com/joepie91/status/1017411484509298688