Credential Stealer Spreads Through npm: 314 Packages Compromised via node-ipc Takeover

A maintainer account takeover of node-ipc allowed attackers to inject an 80KB obfuscated credential stealer into 314 npm packages, targeting over 100 sensitive file types including SSH keys. This demonstrates how a single compromised account in a foundational library can cascade through hundreds of downstream dependencies, exposing millions of developers and their credentials to attackers.