Massive Attack on NPM: Over a Billion Infected JavaScript Packages and Only $50 in Damages September 9, 2025