SMUGGLING MALWARE IN TEST CODE

Summary from the TLDR Web Dev newsletter

A npm package called execution-time-async had malicious code hidden in it that was designed to steal login credentials and passwords from various browsers. The attacker, who has been identified, used various tactics to hide the malicious code, including obfuscation and placing it in a seemingly innocuous test file. They seem to be targeting software developers, possibly through social engineering schemes.