TrapDoor spread 34 malicious packages across npm, PyPI, and Crates.io, stealing developer credentials and enabling persistence.
Modern web applications routinely load tens of megabytes of dependencies, frameworks, utility libraries, polyfills, parsers, validators, internationalization tables, assembled from hundreds of npm ...