[crowdstriker]

The maintainer jackton1's response to this is extremely shady. He tries to prove his innocence by showing that renovate bot changed the author of the malicious commit but I'm betting he's behind the whole thing.