Attacks on the NPM supply chain have occurred again

ChainCatcher message, Scam Sniffer has detected another attack on the NPM supply chain. The package @ctrl/tinycolor (with 2.2 million downloads per week) has released a malicious version that runs an information-stealing program during the npm postinstall script execution to scan and steal sensitive data.

This malicious payload abused the legitimate sensitive information scanning tool TruffleHog. Please check if you have downloaded the affected version, pause any installation/update operations, and pin the version to a known safe version.