An NPM package with the tag “-” has had almost 720,000 downloads since its release in the npm register at the beginning of 2020.
This is because the packet is fed whenever someone makes a typo while executing npm commands.
There is only one version of the package and this version “0.0.1” contains three files, but the contents of the files have nothing groundbreaking and mainly contain skeleton code.
The obviously useless package “-” serves as a dependency for over 50 npm packages.
But it is still something to worry about. Although the package does not contain much at the moment, it may have a newer version that is more malicious.
For more information, read the original story in Bleeping Computer.