Dev snared in crypto phishing net, 18 npm packages compromised

Attackers phished an npm package maintainer, reset his 2FA, and published malicious updates to 18 widely used npm packages that injected code into clients to intercept and rewrite cryptocurrency and Web3 transactions (Ethereum, Bitcoin, Solana, Tron). The compromised packages (accounting for ~2 billion downloads/week) were live for about two hours before removal; a ripgrep search pattern (_0x112fa8) and package list were provided as indicators, and no confirmed theft was reported at the time of the report.