The node-ipc supply-chain attack also made its way into Unity, albeit in the milder "leave a file on the desktop" form:

https://twitter.com/hybridherbst/status/1504223953627369480