Malware has been seen within UA-Parser.js Library. That reminds me of Kaseya and Solarwinds.

How to protect yourself? 

https://medium.com/it-sicherheit-de/malware-innerhalb-von-javascript-bibliothek-ua-parser-js-entdeckt-df3b730cd092