Moment at 3:38 in A single PR just hijacked the NPM registry... by Fireship.
The malware forged commits to blend in with AI-generated code and embedded itself directly into developer IDEs like VS Code, causing the worm to re-execute itself even after the infected packages were removed
Saved by AironD.