Sophisticated Malicious npm Packages Evade Defenses; Possible Nation-State Origin

Newly discovered malicious npm packages demonstrate advanced evasion techniques, suggesting possible nation-state involvement, though no attribution is confirmed. The sophistication indicates a high-capability actor, but the source lacks direct evidence. This highlights growing supply-chain risks in the software ecosystem.