“Out of the ~320k new npm packages or versions that Sandworm has scanned over the past week, at least ~185k were labeled as SEO spam.”
More than 93,000 of them point to the same Telegram channel promising millions without leaving home. In one hour, 1,583 e-book spam packages went up. All of them were still live on npmjs.com. Microsoft owns the registry, and a single Telegram scam out-publishes the JavaScript community without anyone noticing.