A malicious version of bootstrap-sass was published containing a backdoor allowing remote code execution via a crafted cookie.
bootstrap-sass had ~28M downloads; the tainted version was pulled within days.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.