Malicious npm packages targeting Cursor macOS users stole credentials and disabled updates, impacting 3,200+ downloads.

Supply chain attack compromises the popular rand-user-agent scraping NPM package to deploy and activate a backdoor.