discovered
npm-global-util is identified in the SafeDep analysis "npm-global-util: Credential Theft and Supply Chain Attack". npm-global-util is a malicious npm package by maintainer raya4321 that exfiltrates credentials and system recon data via a preinstall hook. Part of a 16-package campaign targeting Apple developer CI/CD environments, with a second-stage that attempts to poison apple-app-store-server-library.