Supply Chain Attack on npm Packages via Maintainer Phishing (Campaign)

A phishing attack against a popular npm maintainer resulted in token theft and the publication of malicious package versions across multiple npm packages (including eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, is, got-fetch) and a PyPI package (num2words). The malicious packages used postinstall scripts to deploy Windows malware (Scavenger), executing malicious DLLs via rundll32 under a disguised function to evade most antivirus engines; the incident represents a cross-ecosystem supply-chain compromise with active exploitation.