A popular NPM package secretly hijacked WhatsApp accounts and siphoned private chats, evading detection for months.
A popular open-source package secretly siphoned credentials and messages, leaving developers-and their users-exposed.