pnpm-lock.yaml

• Malicious npm packages abuse dependency confusion to profile developer environments

  Malicious npm packages abuse dependency confusion to profile developer environments A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft

• Typosquatted npm packages used to steal cloud and CI/CD secrets

  Typosquatted npm packages used to steal cloud and CI/CD secrets The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI/CD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to

• Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

  Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across

• "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages

  "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and w

• Malicious node-ipc versions published to npm in suspected maintainer account compromise

  Malicious node-ipc versions published to npm in suspected maintainer account compromise On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node... Malicious node-ipc Versions P

• TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

  TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "

All reports →

• Connector · intel_report_ingest8