[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFZ7BufoI_MKzjB6m8W4IAIBbXF8n65xoqBjXXTdcRBI":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0807f3fc-7f14-43b4-9d7d-b5e0480bf499","Typosquatted npm packages used to steal cloud and CI\u002FCD secrets","typosquatted-npm-packages-used-to-steal-cloud-and-ci-cd-secrets-ba519c","The Mini Shai-Hulud campaign used malicious npm packages to target cloud and CI\u002FCD credentials across developer environments. This report details the attack chain, detection opportunities, and mitigation guidance to help organizations identify and disrupt related activity. The post Typosquatted npm packages used to steal cloud and CI\u002FCD secrets appeared first on Microsoft Security Blog.","Microsoft Security researchers discovered the Mini Shai-Hulud campaign, which leveraged typosquatted npm packages to target and exfiltrate cloud and CI\u002FCD credentials from developer environments. The campaign demonstrates a sophisticated supply chain attack vector exploiting the npm ecosystem. The report provides technical analysis, detection methods, and mitigation strategies to help organizations defend against similar credential theft operations.","Typosquatted npm packages steal cloud and CI\u002FCD credentials in Mini Shai-Hulud campaign.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F05\u002F28\u002Ftyposquatted-npm-packages-used-steal-cloud-ci-cd-secrets\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F04\u002FMS_Actional-Insights_Rapid-response.jpg","2026-05-29T03:04:52+00:00","2026-05-29T06:00:23.995931+00:00",9,[17,20,23,25],{"name":18,"type":19},"Mini Shai-Hulud","campaign",{"name":21,"type":22},"npm","technology",{"name":24,"type":22},"CI\u002FCD",{"name":26,"type":27},"Microsoft","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[26],{"controls":52,"vendors":131},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,117,123],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[132],{"slug":133,"name":26,"logo_path":134,"roles":135},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"typosquatted-npm-packages-target-developer-credentials","Typosquatted npm Packages Target Developer Credentials","The Mini Shai-Hulud campaign exploited developers' tendency to make typos when installing npm packages, creating malicious packages with names similar to legitimate ones. Once installed, these packages executed code to steal cloud and CI\u002FCD credentials from developer environments. This attack highlights the critical risk of supply chain vulnerabilities in modern software development, where a single typo can compromise entire cloud infrastructures. Organizations must implement strict package verification processes and educate developers about typosquatting risks.",[142,143,144,145,146],"CIS Control 16.7","NIST SP 800-161","NIST SC-7","CIS Control 6.1","OWASP SCVS",{}]