We detected this issue late yesterday through an NPM notification which kicked off a formal security review on our side. We remediated the affected code immediately and revoked malicious access. There is no evidence of customer impact. We are continuing to verify the details and will follow up later today with a fuller update and any recommended next steps.