NPM AUTHOR QIX COMPROMISED VIA PHISHING EMAIL IN MAJOR SUPPLY CHAIN ATTACK

Summary from the TLDR Web Dev newsletter

A phishing attack compromised the npm account of the npm package maintainer Qix, leading to malicious versions of widely-used JavaScript packages like chalk, debug, and strip-ansi that collectively receive billions of downloads weekly being published. The attackers injected cryptocurrency-stealing malware that redirects crypto transactions to their own addresses across 19 compromised packages.