A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.