From Dev.to
A Web3 library shipped malware to npm with valid provenance. Block install scripts you never reviewed.
Originally published on voirlabs.io by Asad Naeem. When npm install script malware turns up, the first suspect is a stolen npm token. This weekend's case points elsewhere: SafeDep found it "points to...