discovered 2025-09-16
Compromised npm maintainer accounts across 6+ organizations (jaredwray, sitthidet_arv, onereach.user, qlikossbuild, st-team, multiple @deliveroo accounts) used simultaneously for mass publishing.
