fsevents supply chain attack (Incident)

The fsevents npm package previously fetched remote binaries from a public S3 bucket which became dangling and was hijacked in April 2023; the attacker replaced the binaries with information-stealing malware as a proof-of-concept. AWS reclaimed the bucket and fsevents no longer downloads those binaries as of v1.2.11, but installations existing before the April 2023 hijack may still be infected and should be audited or remediated.