ua-parser-js is hijacked and installing xmrig miners on machines that tries to install it.
https://unpkg.com/browse/[email protected]/ and https://unpkg.com/browse/[email protected]/ is affected from what I can tell.