NIGHTMARES ON NPM: HOW TWO MALICIOUS PACKAGES FACILITATE DATA THEFT AND DESTRUCTION

Summary from the TLDR Web Dev newsletter

Two malicious npm packages, transferwise-iconfont and protect-api, were recently discovered. The former exfiltrates sensitive data, while the latter obfuscates destructive code to delete system files. Malicious open-source packages use tactics like namespace mimicry, obfuscation, and delayed execution for attacks.