A package impersonating a 'Fall Guys' API read local Discord leveldb files to steal Discord authentication tokens.
One of several npm packages in a campaign targeting Discord tokens.
A package created specifically to carry a malicious payload.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.