Three popular npm packages, @rspack/core, @rspack/cli, and Vant, were compromised through stolen npm account tokens, allowing threat actors to publish malicious versions that installed cryptominers.

dYdX has been targeted by bad actors using malicious packages to empty its user wallets.