fsevents supply chain attack

The fsevents npm package previously pulled certain remote binaries from a public S3 bucket (fsevents-binaries.s3-us-west-2.amazonaws.com). At some point the bucket expired and the domain became dangling, and in April 2023 it was hijacked by an unknown actor (reportedly a security researcher), who replaced the binaries with information stealer malware as a proof of concept.

The bucket has since been reclaimed by AWS, and as of version 1.2.11, fsevents no longer downloads binaries from the bucket at all. Therefore, existing installations of this package (prior to April 2023) may remain impacted and their hosts might be infected by the malware binaries, but new installations (regardless of version) do not contain any malicious binaries.