Malicious node-ipc versions published to npm in suspected maintainer account compromise

Snyk reported multiple active supply‑chain attacks and a high‑severity template injection: (1) On May 14–15, 2026 malicious versions of the popular npm package node‑ipc were published after a suspected maintainer account compromise. (2) On May 11, 2026 the “Mini Shai‑Hulud” worm compromised 84 npm artifacts across @tanstack/* and other packages by chaining a GitHub Actions “Pwn Request,” cache poisoning, and OIDC token extraction from runner memory — producing packages with valid SLSA Build Level 3 attestations. (3) A malicious PyPI release of the lightning package contained a Bun‑based, on‑进口