Since there's also an official announcement, I guess it's OK to share the email here:

Hi,

I'm Denis, a security researcher at Element. I'm emailing you because I determined you are a package maintainer for either Element Web/Desktop or matrix-js-sdk based on information from repology.org.

I'm writing to inform you that there will be a coordinated security release for a critical flaw happening on Monday, Sep 13th for several Matrix clients/libraries, including Element Web/Desktop and matrix-js-sdk.
+See https://matrix.org/blog/2021/09/10/pre-disclosure-upcoming-critical-fix-for-several-popular-matrix-clients.

We apologize for the rather short notice -- various factors prevented us from reaching out earlier.

Kind regards,
Denis

if nheko uses the matrix-js-sdk, they may be affected as well from my understanding

In reply to @ma27:nicht-so.sexy
ah you were faster, just got an email from element for that :)