On July 1, SlowMist issued a security alert regarding a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, specifically targeting npm users, DeFi developers, and trading bot users. This attack involved 30 malicious npm packages, with [email protected] appearing as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository, which displayed approximately 2,300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, indicating a clear signal. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonics, and API tokens exposed in source code. SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.