It's cute that this software supply chain attack on NPM directly targets Ethereum users who are supposed to check every smart contract they want to interact with to protect themselves but don't seem to use the same rigour when checking code they include.
(Original title: Hundreds of code libraries posted to NPM try to install malware on dev machines)