The third wave of the Shai-Hulud worm ("Here We Go Again," August 4, 2026), compromising 435 npm packages across 2,193 versions. The payload now ships as a compiled Bun bundle, resolves fallback domains from a smart contract, and republishes with valid SLSA provenance using stolen GitHub OIDC identity.
A TeamPCP worm operation that hijacked trusted npm organizations in May 2026: 43 @tanstack packages on May 11 (with Mistral AI's npm and PyPI SDKs on May 11-12), then 300+ @antv packages plus timeago.js, jest-canvas-mock, jest-date-mock and size-sensor on May 19 via a stolen maintainer account. The payloads -- an import-time router_init.js in the TanStack wave and a Bun-run preinstall bundle in the @antv wave -- harvest cloud, GitHub and npm credentials and republish themselves into the victim's packages.
A self-propagating PyPI worm (June 2026) that uses a malicious .pth startup hook to auto-run a Bun-based _index.js credential stealer whenever any Python process starts. It harvests cloud tokens and developer secrets and exfiltrates them to an Anthropic-API lookalike endpoint; it is technically related to Shai-Hulud but targets PyPI.
A May 2026 RubyGems campaign that mass-published thousands of throwaway gems abusing RubyDoc.info documentation builds -- a package .yardopts "--load" directive runs attacker Ruby with no install required. The payloads scraped UK council portals and exfiltrated the data through rubygems.org's own API; public research attributed the operation to an OpenAI agent swarm.
A threat actor behind a series of npm and PyPI supply chain attacks from March 2026 onward, identified by shared tooling and the "TeamPCP" label in attacker repositories. It compromises or clones publishing accounts for high-download packages -- including telnyx, lightning, intercom-client, and SAP CAP packages -- to inject credential-stealing payloads.
An npm supply chain worm (first seen March 2026) that published dozens of packages impersonating internal enterprise SDKs across the @emilgroup and @teale.io namespaces, each carrying a malicious postinstall payload. It spreads by compromising developer environments and republishing through new namespaces, and was later linked to the TeamPCP threat actor.
A Lazarus Group campaign that lures developers with fake cryptocurrency-recruiter pitches, then delivers 192 malicious npm and PyPI packages impersonating graph-algorithm and big-number math libraries. The malware fires the moment the library is imported, staging a multi-step downloader that pulls a remote-access trojan from attacker-controlled infrastructure.
A self-labeled npm supply chain worm (February 2026) that published 19 low-suspicion packages alongside typosquats of developer tools such as Claude Code. Its payload propagates through the victim's npm publishing credentials, with a parallel opencraw package serving as a command channel.
The second wave of the Shai-Hulud worm ("The Second Coming," November 24, 2025), compromising 795 npm packages with over 100 million combined downloads. It shifted to preinstall hooks with a Bun-run payload and added randomly named exfiltration repos and a data-wiping component, while keeping wave 1's credential theft and self-propagation.
An npm supply chain campaign (first seen July 2025) of more than 180 attacker-published packages that typosquat popular developer tooling and slopsquat AI-hallucinated package names. Rather than bundle a payload, each package pins a Remote Dynamic Dependency -- a package.json dependency set to an attacker http(s):// URL instead of a version -- so npm fetches and runs the malicious code at install time while the package appears to declare zero dependencies. The retrieved information stealer harvests npm and GitHub tokens, SSH keys, and developer environment secrets.
The first known self-replicating worm on the npm registry (September 2025). After compromising a maintainer account it injects a postinstall bundle.js into every package that account owns, steals cloud and GitHub tokens, and exfiltrates private repositories to new public ones; the first wave compromised over 1,000 packages including @ctrl/tinycolor.
An npm account takeover (September 2025) in which maintainer "qix" was phished and 18 of the most-downloaded utility packages -- including chalk, debug, and ansi-styles -- were trojanized. Each injected a browser-side cryptocurrency wallet drainer that silently rewrites transaction destinations to attacker-controlled addresses.
A credential-stealing campaign (August 2025) that compromised an Nx maintainer's npm account and shipped malicious versions of the nx build tool (nearly a billion downloads). A postinstall telemetry.js harvests cloud tokens and secrets and exfiltrates via attacker GitHub repositories; it shares methodology with the later Shai-Hulud worm.
A Lazarus Group campaign (July-August 2023) that typosquatted popular Python tools on PyPI across two waves totaling 27 packages. The payloads fingerprint the victim machine and fetch XOR-encrypted second-stage code from attacker C2 servers, while hosting functional-looking source on GitHub to appear legitimate.
An npm supply chain campaign (first published December 2021, disclosed July 2022) of more than two dozen packages typosquatting popular icon and UI libraries. Their obfuscated payload runs in the browsers of end users, hijacking HTML form submissions to steal credentials and other input, across 27,000+ combined downloads.