Two malicious npm packages were discovered on the npm open source package manager, which leverages GitHub to store stolen Base64-encrypted SSH keys obtained from developer systems that installed the malicious npm packages. In recent weeks, two suspicious npm packages, namely warbeast2000 and kodiak2k, were discovered in multiple versions.

Source: GBHackers