Malicious NPM "Sandworm" packages targeting AI toolchains and DevSecOps (phoenix.security)

With the recent 'Sandworm' attack involving AI-generated NPM packages, we're seeing a new supply chain vector: developers asking LLMs for library recommendations and getting hallucinated (but real and malicious) package names.