shai-hulud

StepSecurity and Socket report that [email protected] on npm steals credentials and AI-tool configs, and installs a monitor that deletes files if a stolen GitHub token is revoked.

Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled since May 2026, became reachable again on September 16 with their malicious tags intact, silently re-running the payload.

A self-propagating worm hijacked keyv and related npm packages on August 4 after a maintainer's GitHub account was breached, spreading to 1,300+ package versions.

TeamPCP's May 11 supply-chain attack abused a pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token theft to ship 84 malicious TanStack versions and spread to Mistral AI, UiPath and others.

Attackers published lightning 2.6.2 and 2.6.3 to PyPI on April 30, executing an obfuscated JavaScript payload to harvest cloud credentials from anyone who imported the package. Maintainers quarantined the malicious builds within 42 minutes.

A malicious build of @bitwarden/[email protected] was live on npm for roughly 93 minutes on April 22 after attackers used credentials stolen from Checkmarx to push a self-propagating worm that harvests cloud, Git, and AI tooling credentials.