Software packages with more than 2 billion weekly downloads hit in supply-chain attack
arstechnica.com
Incident hitting npm users is likely the biggest supply-chain attack ever.