npm security update: Attack campaign using stolen OAuth tokens | The GitHub Blog
https://github.blog/2022-05-26-npm-security-update-oauth-tokens/