When `npm install` Becomes a Trap: The New Wave of NPM Malware

A logging library shouldn't be able to steal your AWS keys — yet that's exactly what the latest wave of npm malware is built to do, and it changed how I install.