A coordinated supply chain attack has targeted the npm ecosystem, involving 30 malicious packages, according to a SlowMist Security Alert. Attackers distributed JavaScript infostealers by creating fake trading bot repositories and DeFi-themed npm packages. The stake-math@3.5.4 package was identified as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository, which showed signs of anomalies with about 23,000 similar forked repositories under the poly-stocks account. The attack poses a risk of theft of sensitive data, including crypto wallets, browser cookies, passwords, developer credentials, private keys, seed phrases, and API tokens. Developers are advised to remove affected packages, audit dependencies and CI logs, treat systems that have run npm install as compromised, rotate exposed credentials, and rebuild environments from clean images.