A malicious npm package named 'nicegui' version 0.1.4 was published by the threat actor 'ryanmccollum1' as a typosquatting attempt targeting the popular Python NiceGUI framework. This package is part of a supply chain attack campaign that also includes 'redeem-onchain-sdk'. The malicious code collects sensitive credentials such as SSH keys, AWS credentials, .npmrc tokens, Docker authentication data, Chrome saved logins, .env files, and git history, and exfiltrates this data over a raw TCP socket to an AWS-hosted command and control server.