NPM packages are attacked again. The first infected package is go-template then hundreds. The most major ones are Zapier, ENS, AsyncAPI, PostHog, Browserbase, and Postman.'

Other source: https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised

* {
  letter-spacing: clamp(
    -0.05em,
    calc((1em - 1rem) / -10),
    0em
  );
}