Responsible disclosure: the `ua-parser-js` package used by `browser-sync` was compromised.

New installs are safe but you may want to `npm install browser-sync` on any existing projects to make sure you don’t have a compromised version locally.https://t.co/PchLAyfdZ1

— Eleventy 🎈🐘 fosstodon.org/@eleventy (@eleven_ty) October 26, 2021