The Shai-Hulud campaign has compromised over 400 packages across npm and PyPI, delivering credential-stealing malware to developers. The attack involves hijacking OIDC tokens and publishing malicious package versions with verifiable provenance attestation. Affected projects include TanStack, Mistral AI, Guardrails AI, UiPath, and OpenSearch.
Leggi su GoYou