Malicious node-ipc versions published to npm in suspected maintainer account compromise
2026-05-17T20:51:59Z•6c68e558141b616d24f63efc7843f5ccd904b61dc803e11b80af597b136cc66c
BunCVE-2026-40478GitHub ActionsMini Shai-HuludOIDC token extractionPyPISLSA Level 3TanStackThymeleafadvisorycache poisoningcredential stealermaintainer account compromisemalicious packagesnode-ipcnpmpatchingrotationsupply chain
What happened
Snyk blog alerts covering multiple active supply-chain compromises and a high-severity template-injection vulnerability. Key incidents: malicious node-ipc npm versions published (suspected maintainer account compromise), the Mini Shai-Hulud worm that compromised 84 npm artifacts (TanStack and others) via GitHub Actions "Pwn Request", cache poisoning and OIDC token extraction—producing builds with valid SLSA Level 3 attestations—and a Bun-based credential-stealer shipped in a malicious lightning PyPI release. Also highlights CVE-2026-40478 (Thymeleaf template injection, CVSS 9.1) with immediate
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 6c68e558141b616d24f63efc7843f5ccd904b61dc803e11b80af597b136cc66c
- Enrichment time
- 2026-05-17T20:51:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.