Infostealer campaign compromises 10 npm packages, targets devs

Sonatype researchers discovered a supply-chain campaign in which ten npm packages—including the widely used country-currency-map—were updated with obfuscated scripts (/scripts/launch.js and /scripts/diagnostic-report.js) that steal environment variables and exfiltrate them to a pipedream.net endpoint; several compromised versions remain available on npm and the maintainer of country-currency-map deprecated the malicious release and recommended reverting to the prior safe version.