They had an issue where they were responding with 302s redirecting to malicious adware:
https://twitter.com/unpkg/status/852660203275276289
They promised a post-mortem which (to my knowledge) never happened:
https://twitter.com/unpkg/status/852666784792444928
I removed unpkg from my infrastructure and won't be using any of these services again. The minimal gains aren't worth the risk in my estimation.