Big list of npm packages by maintainer qix has been hacked: https://www.npmjs.com/~qix Notably: debug, chalk Malware payload here:

Gist

DO NOT EXECUTE. https://github.com/chalk/chalk/issues/656

DO NOT EXECUTE. https://github.com/chalk/chalk/issues/656 - chalk-source-index-with-malware.js