Malicious NPM packages abuse Adspect redirects to evade security

Researchers found seven npm packages published by a single account that include malicious JavaScript which fingerprints visitors, evades analysis (blocks DevTools, right-click, etc.), and uses the Adspect API to distinguish researchers from real victims before redirecting targeted users to fake cryptocurrency scam pages; one package appears to be a decoy. The report highlights supply-chain abuse on the npm registry and documents package names and the cloaking/fingerprinting TTPs used to enable fraud.