Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?
The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further.
For example:
find . -type f | grep -P "/Math_Symbol\.js$"Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties
loading story #49171734
Highly recommend `fd` for the sheer speed:
fd -HI "^(setup\.mjs|Math_Symbol\.js|math_init\.js)$"
2. `brew install fd`
This article has a lot of information and ways to check & clean: https://safedep.io/keyv-npm-supply-chain-compromise/
loading story #49171741
find . -type d -name node_modules -prune -exec find {} \( -name setup.mjs -o -name math_init.js -o -name Math_Symbol.js \) \; 2>/dev/null