Postmortem for Malicious Packages Published on July 12th, 2018
I don't usually repost the same comment from one story to the next, but this might be helpful...Here's how I checked my own machine, though I was already confident I wouldn't be affected:  find ~ -name eslint-scope -exec grep -H version '{}/package.json' \;

If you use yarn exclusively, this will also work:  yarn cache list | grep eslint-scope-3.7.2