Self-propagating npm worm steals tokens via postinstall hooks, impacting six packages and expanding supply chain attacks.

Note: uvx pywho is not recommended — it runs inside uv's ephemeral sandbox, so the output reflects that temporary environment instead of your actual project. Always install pywho into the environment ...