Malicious Rspack, Vant packages published using stolen NPM tokens

Multiple popular npm packages (@rspack/core, @rspack/cli, and Vant) were compromised via stolen npm tokens allowing attackers to publish malicious releases that install the XMRig Monero miner during postinstall. The malware fetches configuration from an external server, performs reconnaissance (ipinfo.io), downloads an XMRig binary from GitHub (renamed in Vant to blend in), limits CPU use to 75% to evade detection, and affected numerous versions; maintainers have released cleaned updates and advised upgrading to safe versions.