One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK

Between 23 and 25 October 2026, the npm account "wiseke" published 14 packages across four scopes, including @greenlake/auth and @sxm-web/client-sdk-core. GitHub reviewed all of them as malware the sa