color npm package compromised
fasterthanli.me
Note: the situation is still unfolding, I’ll update this article as more comes in. On September 8 2025, around 13:00 UTC, someone compromised Josh Junon’s npm account (qix) and started publishing b...