A maintainer's account was compromised and a malicious eslint-scope version published that attempted to exfiltrate npm authentication tokens.
eslint tooling is nearly ubiquitous in JS projects; npm revoked all tokens as a precaution.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.