Related: NPM debug and chalk packages compromised - https://news.ycombinator.com/item?id=45169657