AI-Generated npm Malware Leaks Its Own GitHub Token

A cluster of high‑impact supply‑chain and credential‑theft incidents and trends: an AI‑generated npm infostealer accidentally leaked its own GitHub token; malicious VS Code extensions (Nx Console) and other supply‑chain attacks led to GitHub repository compromise and theft of Grafana source code (TanStack link); Mini Shai‑Hulud and other npm worms hit large package ecosystems; attackers are shifting from typosquatting to realistic package impersonation and SEO‑poisoning lures that distribute infostealers (targeting LLM sites and crypto developers). Phishing tooling and kits (Kali365) continue‑