discussion is already going on reddit: https://www.reddit.com/r/programming/comments/qdlela/breaking_npm_package_uaparserjs_with_more_than_7m/ https://www.reddi

discussion is already going on reddit: https://www.reddit.com/r/programming/comments/qdlela/breaking_npm_package_uaparserjs_with_more_than_7m/ https://www.reddit.com/r/programming/comments/qdlela/breakin... The compromised package: https://www.npmjs.com/package/ua-parser-js https://www.npmjs.com/package/ua-parser-js 7,680,657 downloads a week Version 0.7.28 is still good, anything above that is compromised > 0.7.29 includes scripts that download and execute binaries. From the command-line arguments, one of them looks like a cryptominer, but that might be just for camouflage. Probably one of the biggest reasons it's downloaded so much is that it's a direct dependency of Facebook's "fbjs" package which is downloaded 5.7mil/week: https://www.npmjs.com/package/fbjs https://www.npmjs.com/package/fbjs https://github.com/facebook/fbjs/blob/main/packages/fbjs/package.json#L72 https://github.com/facebook/fbjs/blob/main/packages/fbjs/pac... Someone has already filed an issue: https://github.com/facebook/fbjs/issues/464 https://github.com/facebook/fbjs/issues/464