MALICIOUS NPM PACKAGE USES HIDDEN PROMPT AND SCRIPT TO EVADE AI SECURITY TOOLS

Summary from the TLDR InfoSec newsletter

A typosquatted npm package, eslint-plugin-unicorn-ts-2, poses as a TypeScript ESLint plugin and runs a post-install script that steals environment variables and embeds a deceptive prompt apparently intended to confuse AI-based scanners.