Hackers breach Toptal GitHub account, publish malicious npm packages

Hackers hijacked Toptal's GitHub organization and published ten malicious NPM packages and modified Picasso package source that included a preinstall script to steal CLI GitHub authentication tokens and a postinstall script to attempt filesystem wipes; private repositories were briefly made public. The malicious packages were available for a short period and reportedly downloaded thousands of times, though Toptal later stated most downloads were automated scanners and that only a limited number of unique IPs contacted the attacker's webhook, concluding no known impact.