Reports suggest hackers have hijacked a common JavaScript package, allowing them to redirect wallet transactions to their own accounts