A new attack on the NPM supply chain has been identified, involving the popular package @ctrl/tinycolor, which is downloaded 2.2 million times weekly. The malicious version includes an information stealer that activates during npm's postinstall script, using TruffleHog to scan for and exfiltrate sensitive data. Users are advised to verify their installations, halt updates, and revert to a secure version to mitigate risks.