‘Mini Shai-Hulud’ malware compromises hundreds of open-source packages in sprawling supply-chain attack

Multiple CyberScoop stories highlight an active, high-impact threat landscape: a sprawling supply‑chain campaign dubbed “Mini Shai‑Hulud” has compromised hundreds of open‑source packages across major registries by abusing legitimate-looking release signatures and the software update process; Google researchers also observed an AI-developed zero‑day before widespread exploitation; Microsoft’s May Patch Tuesday fixed 137 vulnerabilities (13 critical); and data‑extortion activity (ShinyHunters) targeted Instructure/Canvas affecting thousands of schools. Coverage also notes advances in device for‑