> Oh boy, it's a big one.

Yup the "Update" in TFA is scary:

"Update — August 4, 2026, 13:37 CEST: At least 434 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing."

Lots of pain ahead.