Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.
If you're considering PuppeteerSharp for PDF generation, here's the version of the story that doesn't show up in the "getting started" docs.