Self-propagating npm worm steals tokens via postinstall hooks, impacting six packages and expanding supply chain attacks.

The update was announced to all admins via email; they should apply it promptly. Code injection is a risk. As announced on ...