The attack event targeting the NPM Supply Chain has occurred again, with @ctrl/tinycolor releasing a malicious version.

PANews reported on September 16 that Scam Sniffer has detected another attack targeting the NPM Supply Chain. A malicious version of @ctrl/tinycolor (which has a weekly download of 2.2 million times) was released, which runs an information-stealing program during the npm postinstall script execution to scan and steal sensitive data. This malicious payload abused the legitimate sensitive information scanning tool TruffleHog. Please check if you have downloaded the affected version, pause installation/updates, and pin the version to a known safe version.