A Day in the Life of a Strategy Co-Op in Snyk’s Boston Office

Multiple related supply‑chain attacks in May 2026 targeting open‑source packages (npm and PyPI) and CI workflows. The Mini Shai‑Hulud campaign and related incidents compromised maintainer accounts and published hundreds of malicious npm package versions (including AntV and TanStack ecosystems and node-ipc), while a follow‑on event impacted the Microsoft‑associated durabletask PyPI package. Attack techniques include maintainer account compromise, GitHub Actions "Pwn Request" abuse, cache poisoning, OIDC token extraction from runner memory, and misuse of valid SLSA attestations — enabling wide‑r