npm packages hit by phishing-based supply chain attack, exposing developers to malware and remote access threats.