Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Security Blog (May 2026) details multiple malicious npm package campaigns that abuse dependency confusion, typosquatting, and compromised packages to profile developer and build environments and to steal cloud and CI/CD credentials. The activity includes 33 malicious npm packages used for reconnaissance and exfiltration, the Mini Shai‑Hulud payload (compromised @antv packages) that runs during npm install and harvests credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password, and related supply‑chain tradecraft. The reports describe the attack chains, observed techniques,