Malicious node-ipc versions published to npm in suspected maintainer account compromise

Multiple high-impact package supply-chain incidents reported in May 2026: malicious node-ipc versions were published to npm (May 14–15); the “Mini Shai-Hulud” campaign compromised 84 npm artifacts across 42 @tanstack/* (and other) packages via a chained GitHub Actions “Pwn Request,” cache poisoning, and OIDC token extraction from runner memory—producing packages with valid SLSA Build Level 3 attestations (May 11); a malicious PyPI release of lightning contained a Bun-based credential stealer that executes on import; and a separate high-severity Thymeleaf template-injection vulnerability (CVE-⁠