CISA credential leak raises alarms, and Capitol Hill demands answers

Multiple high‑risk supply‑chain and credential incidents dominated the CyberScoop feed: a researcher disclosed a severe CISA credential leak that prompted Congressional inquiries; the Mini Shai‑Hulud malware wave compromised hundreds of npm packages (stealing publishing tokens, installing OS‑level backdoors and persisting in developer CI); Microsoft disrupted Fox Tempest, a service that abused software verification/signing to slip malware and ransomware tools past defenses; and Verizon’s DBIR found exploited vulnerabilities are the top initial attack vector as patching/remediation lags. Other: