On September 8, 2025, NPM reported that several libraries were compromised in a user-side man-in-the-middle attack. This research dives into the details about how the attack works.