A single PR just hijacked the NPM registry...

A single PR just hijacked the NPM registry...