discovered
@velora-dex/sdk is identified in the SafeDep analysis "Malicious @velora-dex/sdk Delivers Go RAT via npm". Version 9.4.1 of @velora-dex/sdk, a DeFi SDK with ~2,000 weekly downloads, was compromised to deliver a Go-based remote access trojan (minirat) targeting macOS developers.