gotta love npm community . here's the summary:

1. someone compromises eslint to scan for other npm credentials and upload them.

2. the code has a bug that fails in some conditions.

3. this probably ran in several devs/CI systems and stole tons of credentials

4. the thread is about pinning the unaffected older version on all other high profile packages

5. people start to suggest fixes for the payload exec'ing code from an http request.

in the end, attackers now have hundreds of credentials for less visible projects, and even a fix for their code. I'd say attackers are writting this off as a huge success.

npm should proactively revoke everyone's token now!