It's not mining, it's stealing people's wallet credentials (even worse). This package is included in a lot of things, some of which you may be using (like Visual Studio Code, although according to someone on reddit VS hasn't updated to an affected version yet)
1 comment
[ 2.7 ms ] story [ 12.0 ms ] thread