{"content":"🚨Another NPM supply chain attack `@ctrl/tinycolor` (2.2M weekly downloads) shipped malicious versions that run an infostealer during npm postinstall to scan for and exfiltrate sensitive data. The payload abuses TruffleHog, a legitimate secret scanner. Check if you pulled affected versions, pause installs/updates, and pin to known-good releases.","images":["https://d2kdcqywr8ua22.cloudfront.net/uploadfile/article/blog/2025092025/09/16/a2b5f0a4b2914352995857e14bcf918f.png"],"tags":[],"tradingPairs":[],"quotearticleid":0}