According to Koi Security, a legitimate-looking developer managed to slip in rogue code within an npm package called " ...
RedNovember group exploited VPN appliances and firewalls to hit defense contractors, government agencies, and manufacturers ...