There is an active npm security event: https://socket.dev/blog/shai-hulud-strikes-again-v2

At time of writing, Eleventy core and our official suite of plugins are unaffected.