Someone published NPM fork of noble-curves that sent private keys to a server in China. Be careful and check for typos https://blog.phylum.io/typosquat-of-popular-ethereum-package-steals-private-keys/