Malicious npm Packages Target Developers to Steal Credentials

Three malicious npm packages, bitcoin-main-lib, bitcoin-lib-js, and bip40, have been uploaded to the public npm registry, targeting JavaScript developers to steal sensitive data such as browser logins, API keys, and cryptocurrency wallet information. These packages masqueraded as tools related to the popular bitcoinjs project, posing a significant risk to developers who unknowingly added them as dependencies.