Malicious node-ipc versions published to npm in suspected maintainer account compromise

Snyk reported multiple recent supply-chain incidents: on May 14, 2026 malicious versions of the npm package node-ipc were published in a suspected maintainer account compromise; on May 11, 2026 the “Mini Shai-Hulud” worm compromised 84 npm artifacts across 42 @tanstack/* (and other) packages by chaining a GitHub Actions “Pwn Request,” cache poisoning, and extracting OIDC tokens from runner memory — notably producing builds with valid SLSA Level 3 attestations; a malicious PyPI release of lightning delivered a Bun-based credential stealer that executes on import; and separately CVE-2026-40478 (