TLDR: Security researchers have identified a cluster of malicious NPM packages mimicking popular crypto libraries. The packages contain obfuscated code that exfiltrates environment variables and wallet seed phrases.
Malicious Packages Identified:
ethereumjs-walllet(typo of ethereumjs-wallet)web3-utils-prosolana-sdk-helpercrypto-wallet-validator
Over 15,000 downloads recorded before removal. Developers should audit their dependencies immediately.