♲ @Tabletop Scenarios (badthingsdaily@twitter.com): Happy new year.

A developer has just typo'd an upstream package installation to their laptop.

There was a malicious package waiting for that typo.

The post-installation code is exfiltrating environment variables and full directories with .git folders from that shell.