Malicious npm packages abuse dependency confusion to profile developer environments
2026-05-31T08:52:18Z•464ebaae5cf7bc8b3fabe7ee44414c35a89b45fe57946d9334d6ab8a39569274
.NET utilities@antvCI/CDConfluenceF5 BIG-IPKerberos relayLinux intrusionMini Shai‑HuludSEO poisoningScreenConnectStorm-2697The Gentlemencloud credentialscredential theftcryptojackingdependency confusiondetectionlateral movementmitigationnpmransomwareself-propagationsoftware supply chaintyposquatting
What happened
A set of Microsoft Security Blog posts (May 2026) describes multiple active threats and supply‑chain abuse targeting developer and enterprise environments: a dependency‑confusion campaign deploying 33 malicious npm packages to profile developer/build environments; typosquatted and compromised npm packages (including the Mini Shai‑Hulud and compromised @antv packages) that exfiltrate CI/CD and cloud credentials (GitHub, AWS, Kubernetes, Vault, npm, 1Password) during npm install; a Go‑based self‑propagating ransomware family (“The Gentlemen”) used by Storm‑2697 affiliates combining per‑file EpHE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 464ebaae5cf7bc8b3fabe7ee44414c35a89b45fe57946d9334d6ab8a39569274
- Enrichment time
- 2026-05-31T08:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.