I recently was notified about malicious code in the library Polyfill.Io which reads local storage data (including JWT tokens) and stuff.