Typosquatted Packages Turn Trusted Dev Tooling Into a Secret-Harvesting Path

A Solana-themed package campaign shows how npm and PyPI installs can become a delivery route for code that runs before a developer ever opens the library.