Tag: ci/cd targeting

5 Attack Reports | 0 Vulnerabilities

Attack reports

Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages

A supply chain attack compromised multiple @redhat-cloud-services npm packages, executing malicious payloads automatically during installation via preinstall hooks. The attack uses AES-GCM encrypted payloads and obfuscated JavaScript loaders to harvest GitHub Actions secrets, npm tokens, cloud cred…

supply chain attack

ci/cd targeting

Published: June 1, 2026

Downloadable IOCs: 5

Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Threat Intelligence identified an active supply chain attack involving malicious npm packages that employ dependency confusion techniques. Between May 28-29, 2026, a threat actor using three maintainer aliases published malicious packages across nine organizational scopes that mirror real…

credential theft

npm supply chain

ci/cd targeting

dependency confusion

environment fingerprinting

lifecycle hooks

reconnaissance payload

Published: May 30, 2026

Downloadable IOCs: 7

TanStack npm Packages Compromised in Ongoing Supply-Chain Attack

Socket detected 84 compromised TanStack npm package artifacts modified with credential-stealing malware targeting CI systems, including GitHub Actions. Affected packages like @tanstack/react-router have over 12 million weekly downloads. The malicious versions contain router_init.js, a heavily obfus…

credential stealer

supply-chain attack

ci/cd targeting

mini shai-hulud

oidc token theft

router_runtime.js

session p2p network

tanstack_runner.js

Published: May 12, 2026

Downloadable IOCs: 3

Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack

The intercom-client npm package version 7.0.4 was compromised through a malicious GitHub account, introducing credential-stealing malware into a widely used Node.js SDK with approximately 360,000 weekly downloads. The attack deployed two malicious files: setup.mjs, executed via preinstall hook to d…

supply chain attack

ci/cd targeting

github account compromise

mini shai-hulud

Published: April 30, 2026

Downloadable IOCs: 2

PyPI Package Compromised in Supply Chain Attack

The popular PyPI package lightning experienced a supply chain attack affecting versions 2.6.2 and 2.6.3, published on April 30, 2026. The compromise introduced malicious code that executes automatically upon module import, downloading Bun JavaScript runtime and executing an 11MB obfuscated payload.…

supply chain attack

ci/cd targeting

github poisoning

Published: April 30, 2026

Downloadable IOCs: 1

Click here to see more Attack Reports