Reminds you of another npm author going rouge: https://www.bleepingcomputer.com/news/security/dev-corrupts-...