An npm supply chain campaign (first seen July 2025) of more than 180 attacker-published packages that typosquat popular developer tooling and slopsquat AI-hallucinated package names. Rather than bundle a payload, each package pins a Remote Dynamic Dependency -- a package.json dependency set to an attacker http(s):// URL instead of a version -- so npm fetches and runs the malicious code at install time while the package appears to declare zero dependencies. The retrieved information stealer harvests npm and GitHub tokens, SSH keys, and developer environment secrets.