Malware Manipulates AI Detection in Latest npm Package Breach

A malicious npm package (eslint-plugin-unicorn-ts-2, v1.2.1) masquerading as an ESLint plugin was found to contain no linting functionality but instead executed a post-install hook that harvested environment variables and exfiltrated them to a Pipedream webhook. The package used typosquatting, had nearly 17,000 installs, and embedded a prompt designed to manipulate LLM-based code scanners; earlier malicious versions were flagged by OpenSSF but the package remained available on the registry, raising supply-chain security concerns.