seems like the npm repo got hacked and the compromised version was just uploaded