A maintainer's account was compromised and a malicious eslint-scope version published that attempted to exfiltrate npm authentication tokens.
eslint tooling is nearly ubiquitous in JS projects; npm revoked all tokens as a precaution.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.