Active npm supply chain attack using a three-layer transitive dependency chain to deliver a bundled remote-access trojan. The attacker published ioredis-xyz as the entry point, which pulls redis-type-xyz as a relay layer and ulid-xyz as the payload carrier, so installing the top-level package alone is enough to deploy the implant. All three packages were purpose-built for the attack rather than compromised legitimate projects.