Malicious NPM Packages Used in Sophisticated Developer Cyberattack

In October 2025, security researchers uncovered an unprecedented phishing campaign that weaponizes the npm ecosystem—not by infecting developers during package installation, but by abusing…