Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

Supply-chain attacks have evolved considerably in the las two years going from dependency confusion or stolen SSL among ...