Backdoor in event-stream library dependency
Great breakdown of events here:
<a href="https://schneid.io/blog/event-stream-vulnerability-explained/" rel="nofollow">https://schneid.io/blog/event-stream-vulnerability-explained...</a>