ESLint maintainer responds here: https://github.com/eslint/eslint-scope/issues/39#issuecommen...

> One of our maintainers did observe that a new npm token was generated overnight (said maintainer was asleep). We think that token was likely used but are awaiting confirmation from npm. This maintainer has changed password, enabled 2FA, and generated new tokens.