Security experts have warned that a newly discovered supply chain attack targeting npm packages is still active and may ...