More packages poisoned in npm attack, but would-be crypto thieves left pocket change

A phishing-driven supply-chain attack compromised an npm maintainer’s account, allowing attackers to publish malware-laced versions of widely used packages (initially 18 Qix packages, later additional DuckDB and coveops/abi packages). The malicious releases were found in about 10% of cloud environments and could still be available for download; despite large scale potential, on-chain analysis shows only around $925 stolen, and researchers warn organizations to assume malicious package versions may persist and to harden supply-chain and credential defenses.