Attackers have compromised the NPM supply chain by replacing SVG files with malicious scripts, according to a report by SlowMist's 23pds. These scripts exploit cross-site scripting (XSS) vulnerabilities to deceive decentralized application (DApp) users into signing unauthorized transactions, resulting in asset theft. Users are urged to exercise caution and enhance their security measures to protect their assets.