[laserlight]

Considering that only clones are affected, your original tweet is downright wrong. None of the listed projects (python, js, bash, docker, k8s) are affected. Anybody can fork a repository to introduce malware.

[eurasiantiger]

js is a project?

[laserlight]

You're right. It's not. I just copy-pasted the list from the tweet. I assume that the author meant to write jq.