Big list of npm packages by maintainer qix has been hacked: https://www.npmjs.com/~qix
Notably: debug, chalk
Malware payload here: 
Gist
DO NOT EXECUTE. https://github.com/chalk/chalk/issues/656
DO NOT EXECUTE. https://github.com/chalk/chalk/issues/656 - chalk-source-index-with-malware.js