Moment at 2:45 in A single PR just hijacked the NPM registry... by Fireship.
Once triggered, the malware grabbed the NPM publish token, compromised 84 Tanstack packages, and actively scanned the systems of anyone who installed them for other valuable publishing credentials
Saved by AironD.