Axios attacker strikes again! Three NPM packages have been hiding in plain sight for two months

While defenders focused on the high-profile Axios NPM compromise, the same attacker quietly deployed three new malicious packages using identical cryptographic keys to harvest developer credentials for nearly two months, exposing a far broader and more persistent supply chain threat than previously realized.