NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised
I don't know why anyone would auto-download untrusted packages as part of their own build/release chain and not review the code manually. Anything could be in there.The way people use NPM is pure fucking insanity.