tl;dr – Update to npm v6.13.4 as soon as possible on all your systems to fix a vulnerability allowing arbitrary path access.

https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli