A new maintainer added a malicious dependency (flatmap-stream) that targeted the Copay bitcoin wallet, attempting to steal wallet credentials.
event-stream had ~2M weekly downloads; the payload specifically targeted Copay builds to exfiltrate private keys.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.