Malicious npm packages abuse dependency confusion to profile developer environments
2026-05-30T20:52:18Z•cc9ff7992f7ca16834d29bb64e88b230c6435cb16c5c8add3b5a745fceb6ce39
CI/CDConfluenceF5 BIG-IPKerberos-relayMini Shai-HuludScreenConnectThe Gentlemencloud-secretscredential-theftcryptojackingdependency-confusiondetectionlateral-movementmalwaremitigationnpmransomwareself-propagationsupply-chaintyposquatting
What happened
A set of Microsoft Security Blog reports detailing multiple active threats targeting developer and enterprise environments. Highlights include: a dependency-confusion campaign deploying 33 malicious npm packages to profile developer/build environments; typosquatted and compromised npm packages (including the Mini Shai‑Hulud activity) used to steal cloud and CI/CD credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password; a Go-based self‑propagating ransomware family (“The Gentlemen”) used by Storm-2697 affiliates combining per-file ephemeral key encryption with aggressive lateral‑w
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- cc9ff7992f7ca16834d29bb64e88b230c6435cb16c5c8add3b5a745fceb6ce39
- Enrichment time
- 2026-05-30T20:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.