This typosquatting attack on npm went undetected for 2 weeks

Lookalike npm packages grabbed stored credentials

A two-week-old campaign to steal developers' credentials using malicious code distributed through npm, the Node.js package management registry, has been halted with the removal of 39 malicious npm packages."