npm package ambar-src infects 50,000+ hosts across Windows, Linux, macOS. Fake Next.js repos backdoor developer workflows. NCryptYo, DOMOAuth2, IRAOAuth2.0, and SimpleWriter hijack ASP.NET authorization. SafePay ransomware breach at Conduent exposes 25M+ records.