Malicious code in @tallyui/components (npm)

What's happening and what to do

The npm package contains malicious code that can run on a developer's machine or build system once installed, potentially letting an attacker take control or steal data. npm package @tallyui/components, versions 1.0.1, 1.0.2 and 1.0.3. Remove these versions from your projects, pin to a known-safe release, and check for signs of compromise on any system that installed them.