A threat actor called TeamPCP hijacked a trusted npm package maintainer account and injected malicious code into 639 versions of 323 packages, including widely used data visualization libraries with millions of weekly downloads. The malware self-replicates across the npm ecosystem, steals credentials from cloud platforms, CI/CD pipelines, and payment systems, and forges software supply chain verification signatures, meaning infected packages appeared legitimate even to teams using provenance checks. TeamPCP then published the full attack toolkit on a criminal forum, enabling copycat attackers to repeat the campaign against organizations with JavaScript build pipelines.