A malicious version of bootstrap-sass was published containing a backdoor allowing remote code execution via a crafted cookie.
bootstrap-sass had ~28M downloads; the tainted version was pulled within days.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.