Researchers at open-source software firm Sonatype have uncovered multiple malicious packages that disguise themselves as legitimate JavaScript libraries on npm registries to launch cryptominers on Windows, macOS and Linux machines.
https://www.inforisktoday.co.uk/malicious-packages-disguised-as-javascript-libraries-found-a-17782