A former employee's npm access was abused to publish a version injecting a crypto wallet-drainer into any dApp loading the library.
Loaded by many Web3 front-ends via CDN; drained an estimated $600k before mitigation.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.