It's not mining, it's stealing people's wallet credentials (even worse). This package is included in a lot of things, some of which you may be using (like Visual Studio Code, although according to someone on reddit VS hasn't updated to an affected version yet)
1 comment
[ 3.2 ms ] story [ 15.1 ms ] thread