do you publish from a npm workspace & use a root-level ignore file? if so, you should update to npm v8.11.0 or the latest versions of Node.js 16/17/18 to avoid a recently discovered vulnerability that wouldn't respect these files. read the advisory here: github.co/3zebIPH

@npmjs hello kindly remove this person account he is stealing eth from the NPM packages he uploaded. npmjs.com/~mempooluniswap