Npm Supply Chain: Valid Certificates, Stolen Accounts

npm supply chain: valid certificates, stolen accounts

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was issued, and recorded everything in the transparency log. What it cannot do is determine whether the pers…

Microsoft Tracks Mini Shai Hulud Malware Infiltrating the AntV Ecosystem

Reading Time: 3 minutesKey Takeaways: Hackers took over a developer’s account to put bad code into common packages like @antv/g2 and echarts-for-react. The bad code runs automatically during installation, instantly stealing passwords and security keys. The malware uses stolen keys to infect  software packages across the internet. If these packages were used, the software folders must be deleted and all computer passwords changed immediately. A …

Mini Shai-Hulud Compromises @antv npm Packages to Steal CI/CD Credentials

A new and sophisticated supply chain attack has been uncovered, targeting one of the most trusted corners of the open-source software world. Dubbed “Mini Shai-Hulud,” this campaign went after the @antv npm package ecosystem, a collection of widely used data visualization libraries powering dashboards and applications for developers globally. The attack was quiet, precise, and designed to cause maximum damage before anyone noticed. What made this…

Hackers Launch Automated Mini Shai Hulud Supply Chain Attack Targeting Open Source Developer Packages

Cybersecurity compliance firms StepSecurity and SafeDep discovered a coordinated open-source software supply-chain attack that hijacked developer credentials to distribute malicious code updates to downstream users. The automated campaign targeted widely used programming components across public registries, infecting over 320 distinct software packages to harvest sensitive credentials from development environments. Security investigators traced …