Malicious npm packages abuse dependency confusion to profile developer environments

Collection of Microsoft Security Blog reports (May 2026) detailing multiple active threats against developer, cloud, and enterprise environments: a dependency‑confusion campaign that published 33 malicious npm packages to profile developer/build environments; typosquatted and compromised npm packages (including the Mini Shai‑Hulud activity and compromised @antv packages) that steal cloud and CI/CD secrets during npm install; a self‑propagating Go‑based ransomware family (“The Gentlemen”) used by Storm‑2697 affiliates combining per‑file ephemeral key encryption with aggressive lateral‑movement;