An npm supply chain campaign (first published December 2021, disclosed July 2022) of more than two dozen packages typosquatting popular icon and UI libraries. Their obfuscated payload runs in the browsers of end users, hijacking HTML form submissions to steal credentials and other input, across 27,000+ combined downloads.