The attack on the NPM supply chain has occurred again, with @ctrl/tinycolor releasing a malicious version

ChainCatcher message, Scam Sniffer has detected another attack on the NPM supply chain. A malicious version of @ctrl/tinycolor (with 2.2 million downloads per week) has been released, which runs an information-stealing program during the npm postinstall script to scan and steal sensitive data.

This malicious payload abused the legitimate sensitive information scanning tool TruffleHog. Please check if you have downloaded the affected version, pause any installation/updates, and pin the version to a known safe version.