The npm packages were available since July, have elaborately obfuscated malicious routines, and rely on a fake CAPTCHA to ...
Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.