> If you have npm credentials and did npm install the last few hours you should probably revoke your tokens.

You might have to do that anyway - it's not yet clear what other packages, if any, have been affected.