discovered 2026-08-04
Popular key-value storage library (154M weekly downloads). Compromised via jaredwray account takeover. Variant A payload: setup.mjs (29,918 bytes) + Math_Symbol.js stage-two.
