Malicious npm Packages That Evade Defenses
This is an impressive piece of malware . Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.
We haven't written up this one. Schneier on Security has the full story — the link below goes straight to it.