Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised. (jdstaerk.substack.com)