Hackers compromised Toptal's GitHub organization account, gaining access to publish ten malicious packages on the Node Package Manager (NPM) index. These packages included data-stealing code that collected GitHub authentication tokens and wiped victims' systems. The attackers made 73 private repositories public, exposing private projects and source code. The malicious packages were downloaded roughly 5,000 times before being detected, potentially infecting developers with malware.