Four Payloads in One `npm install`: The `coindefi2026` Campaign.

Three malicious npm packages delivering a socket.io RAT with PTY shell, screen capture, and remote control, plus a browser credential stealer targeting Chrome, Brave, and 28 crypto wallet extensions.