Thread by @sugarpirate_

don't forget to also check your local machine (for the backdoor, github.com/dominictarr/ev…, ICYMI)

find / -type d -name "event-stream" -print 2>/dev/null

More specifically, search for `flatmap-stream`, as that is the malicious package:

find / -type d -name "flatmap-stream" -print 2>/dev/null

Thanks @OCombe for pointing this out

✨ And finally you should be using `npm ci` OR `yarn install --frozen-lockfile` to install your deps on your servers:

npm: blog.npmjs.org/post/171556855…
yarn: yarnpkg.com/lang/en/docs/c…