The "Qix" campaign used 25 packages to compromise over 2.5 million downloads.

Malicious npm packages surged 451% year-over-year.

177,000 new malicious packages were detected across registries in the last year.