Nice one, do you know the recent malicious code that hide inside a npm package. Vue CLI got affected because it had dependency on that package. Check out my post here https://medium.com/p/94c908fe7ae3