Malicious node-ipc versions published to npm in suspected maintainer account compromise

Multiple high-impact supply-chain compromises and malicious package releases were reported in May 2026: malicious node-ipc versions were published to npm (suspected maintainer account compromise), 84 @tanstack/* npm artifacts were compromised by the “Mini Shai-Hulud” attack chain (GitHub Actions "Pwn Request", cache poisoning, and OIDC token extraction producing builds with valid SLSA Level 3 attestations), and a PyPI release of lightning contained a Bun-based credential stealer that runs on import. Separately, Thymeleaf template injection (CVE-2026-40478, CVSS 9.1) affects Thymeleaf < 3.1.4;