Ten npm packages, including the widely used 'country-currency-map,' were compromised with malicious code to steal developers' environment variables containing sensitive data. Discovered by Sonatype, the malware sent stolen information to a remote server. The attack likely resulted from compromised maintainer accounts rather than phishing. While the malicious versions remain active for most packages, the 'country-currency-map' maintainer has deprecated the infected version 2.1.8, recommending version 2.1.7 instead. Developers are advised to check their projects and update accordingly.

‍