On September 8, 2025, a remarkably large-scale npm supply-chain attack was uncovered—one of the most severe in JavaScript’s history. A trusted maintainer’s npm account was compromised via phishing, enabling attackers to inject cryptostealer malware into 18 popular packages (e.g., chalk, debug, ansi-styles), collectively accounting for around