“I don’t know what to say. · Issue #116 · dominictarr/event-stream · GitHub”

A popular npm package transferred ownership to what looks like a malicious actor. This is the sort of stuff that keeps me up at night.