Virus in eslint-scope?

[lifeart]

eslint/eslint-scope#39 (comment)

[Turbo87]

@lifeart what do you expect us to do about this?

[rwjblue]

Firstly, the appropriate mechanism to report possible security issues is documented here: https://emberjs.com/security/. We should likely do a better job of surfacing that URL to folks though.

Secondly, there is roughly nothing we can do on our end. The NPM team is tracking the incident response here.

[stefanpenner]

@lifeart thanks for letting us know. We are staying on top of this one.

Personally, I have:

• confirmed I haven not downloaded the malicious packages
• enabled npm's 2FA (yes long overdue)

So in theory, my account (and those NPM packages I have publish writes too) shouldn't be exposed (atleast by me).