I recognised it straight away when it popped up this morning and thought "What the fuck, how could anything even trigger that?". There were no issues mentioning it for the longest time so we figured no way, it must be something besides npm.