discovered 2026-08-04
OneReach @or-sdk/auth. Representative of ~73 compromised @or-sdk packages. Compromised via onereach.user account. Variant B payload.