Malicious node-ipc versions published to npm in suspected maintainer account compromise

Snyk published multiple incidents in May 2026 describing active supply‑chain and malware campaigns across npm and PyPI plus a high‑severity template injection CVE. Key events: malicious node-ipc versions were published to npm (suspected maintainer account compromise, May 14–15); the “Mini Shai‑Hulud” worm compromised 84 npm artifacts across 42 @tanstack/* packages (and related namespaces) via a chained GitHub Actions "Pwn Request", cache poisoning and OIDC token extraction from runner memory — notably producing valid SLSA Build Level 3 attestations (May 11); a malicious lightning PyPI release含