JavaScript packages with billions of downloads were compromised by an unknown threat actor looking to steal cryptocurrency.

A newly disclosed flaw in the Cursor extension allows repositories to automatically execute code when a folder is opened, ...