A new maintainer added a malicious dependency (flatmap-stream) that targeted the Copay bitcoin wallet, attempting to steal wallet credentials.
event-stream had ~2M weekly downloads; the payload specifically targeted Copay builds to exfiltrate private keys.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.