Two NPM Packages With 22 Million Weekly Downloads Found Backdoored

The two libraries are "coa," a parser for command-line options, and "rc," a configuration loader, both of which were tampered with by an unknown threat actor to include password-stealing malware.