A Major Supply Chain Attack Hits the npm Ecosystem

In July, Socket warned us about a phishing campaign targeting npm package publishers. Sadly, a prolific package author (among others, like DuckDB, who explain how the attack worked on them) fell victim to the scam, resulting in some popular packages becoming compromised - https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack

#nodejs