npm phishing attack laces popular packages with malware
go.theregister.com
: The "is" package was infected with cross-platform malware after a scam targeting maintainers