This wasn't an npm vulnerability. It's a direct link to a CDN file that was compromised: https://github.com/iotaledger/trinity-wallet/pull/2565/files...