😭 A Major Supply Chain Attack Hits the npm Ecosystem

In July, Socket warned us about a phishing campaign targeting npm package publishers. Sadly, a prolific package author (among others, like DuckDB, who explain how the attack worked on them) fell victim to the scam, resulting in some popular packages becoming compromised (like Chalk, debug, and others).

Gooding, Brown, et al. (Socket)