Open source package with 1M monthly downloads stole user credentials

(arstechnica.com) by aureliusm | Apr 28, 2026 | 0 comments on HN