Sonatype has identified multiple open source packages named sniperv1, sniperv2, among others that infect npm developers with a Windows info-stealer and crypto-stealer called 'Bladeroid.'
Article Link: npm packages spread 'Bladeroid' crypto-stealer, hijack your Instagram