The affected package has been removed from npm, over 5 hours after it was published. Whew, what a ride.

v0.2.3 publish date: 2025-09-08T13:19:05.292Z