Compromised Rspack npm publishing token distributes cryptomining malware

Rspack disclosed that attackers used a compromised npm token to publish malicious version 1.1.7 of @rspack/core and @rspack/cli on December 19, 2024. The malicious releases were distributed through the legitimate npm channel and contained obfuscated code designed to deploy the XMRig Monero miner when installed, creating a direct software-supply-chain integrity impact. Rspack deprecated the malicious release, reset relevant tokens and issued a clean replacement.