Two malicious NPM packages contain code that would delete production systems when triggered with the right credentials.

A threat actor published backdoored versions of 17 NPM packages from GlueStack in a fresh supply chain attack.