[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f49iB6TkZhMe_yb4YquYxfC8zrDe1jyM33-ogRo_KwCc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":39},"d85e8553-73eb-4a82-8a34-36303c1c4a1d","typosquatted-npm-packages-target-developer-credentials","0807f3fc-7f14-43b4-9d7d-b5e0480bf499","Typosquatted npm Packages Target Developer Credentials","The Mini Shai-Hulud campaign exploited developers' tendency to make typos when installing npm packages, creating malicious packages with names similar to legitimate ones. Once installed, these packages executed code to steal cloud and CI\u002FCD credentials from developer environments. This attack highlights the critical risk of supply chain vulnerabilities in modern software development, where a single typo can compromise entire cloud infrastructures. Organizations must implement strict package verification processes and educate developers about typosquatting risks.","**Immediate actions:**\n- Implement package verification and approval processes before installing dependencies\n- Scan existing npm packages in development environments for known malicious signatures\n- Enable multi-factor authentication for all cloud and CI\u002FCD service accounts\n\n**Long-term improvements:**\n- Establish private npm registries with curated, approved packages for development teams\n- Implement automated dependency scanning tools that check for typosquatting patterns\n- Create isolated development environments that limit access to production credentials\n\n**Detection measures:**\n- Monitor network traffic from development environments for unusual data exfiltration patterns\n- Log and audit all package installations across development infrastructure\n- Set up alerts for credential usage from unexpected geographic locations or IP addresses",[12,13,14,15,16],"CIS Control 16.7","NIST SP 800-161","NIST SC-7","CIS Control 6.1","OWASP SCVS",{},"published","2026-05-29T06:20:14.295955+00:00","2026-05-29T06:20:13.845+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F05\u002F28\u002Ftyposquatted-npm-packages-used-steal-cloud-ci-cd-secrets\u002F","typosquatted-npm-packages-used-to-steal-cloud-and-ci-cd-secrets-ba519c","Typosquatted npm packages used to steal cloud and CI\u002FCD secrets",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[40,44,48],{"slug":41,"name":42,"problem":43},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":45,"name":46,"problem":47},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":49,"name":50,"problem":51},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]