A package impersonating a 'Fall Guys' API read local Discord leveldb files to steal Discord authentication tokens.
One of several npm packages in a campaign targeting Discord tokens.
A package created specifically to carry a malicious payload.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.