Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Security Blog posts (late May 2026) detail multiple active campaigns and threat research: a dependency‑confusion campaign that published 33 malicious npm packages to profile developer and build environments; several typosquatted and compromised npm package campaigns (including Mini Shai‑Hulud and compromised @antv packages) that execute during npm install to harvest cloud and CI/CD secrets (targeting GitHub, AWS, Kubernetes, Vault, npm, 1Password); and guidance on detection and mitigation for supply‑chain and developer‑environment exposures. Additional reporting covers The Gentlemen—