A former employee's npm access was abused to publish a version injecting a crypto wallet-drainer into any dApp loading the library.
Loaded by many Web3 front-ends via CDN; drained an estimated $600k before mitigation.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.