A sophisticated supply-chain attack targeted the npm ecosystem via a malicious update to the widely used @ctrl/tinycolor package (TinyColor), which was trojanized to steal developer credentials, GitHub/npm tokens, cloud secrets, and other sensitive data. The compromised version automatically executed hidden code upon installation, exfiltrating stolen information to an external server controlled by attackers. The attack propagated to over 40 downstream packages, amplifying its reach due to TinyColor’s 2+ million weekly downloads.The breach exposed developers’ machines, CI/CD pipelines, and cloud infrastructure, with experts warning of potential long-term compromise if credentials were not rotated. Socket’s team detected the attack, but the scale suggests many developers may have unknowingly integrated the malware. This incident follows another major npm supply-chain attack just 7 days prior, where 18 packages (with 2B+ weekly downloads) were similarly compromised.Victims face risks of unauthorized access to repositories, cloud environments, and proprietary code, with potential downstream exploits in production systems. The attack underscores vulnerabilities in open-source supply chains, where trusted packages can become vectors for large-scale credential theft and infrastructure hijacking.