#592 — September 9, 2025 Read on the Web A Major Supply Chain Attack Hits the npm Ecosystem — In July, Socket warned us about a phishing campaign targeting npm package publishers. Sadly, a prolific package author (among others, like DuckDB, who explain how the attack worked on them) fell victim to the scam, resulting