Freelance dev shop Toptal caught serving malware after GitHub account break-in

Security researcher Socket discovered that attackers hijacked Toptal's GitHub repositories and injected malicious code into ten npm packages used in the Picasso developer toolbox, enabling GitHub token theft, persistence, and backdoor downloads; Toptal removed the repositories and stated no customers were affected, while Socket recommends token rotation, scanning for malicious lifecycle scripts, and checking dependency logs.