Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Security Blog reports multiple active threats and investigations: a dependency‑confusion campaign using 33 malicious npm packages to profile developer and build environments; typosquatted and compromised npm packages (including the Mini Shai‑Hulud and compromised @antv packages) used to steal cloud and CI/CD credentials during npm install; a self‑propagating Go ransomware family (“The Gentlemen”) that performs aggressive lateral movement; a cryptojacking campaign abusing SEO poisoning, ScreenConnect, and .NET utilities to deploy GPU miners; and a multi‑stage Linux intrusion that pivt