AI Summary

Hundreds of npm and PyPI packages were compromised in a Shai‑Hulud supply‑chain attack that delivers credential‑stealing malware to developers. The attacker hijacked valid OpenID Connect (OIDC) tokens to publish new malicious package versions. These versions carry verifiable provenance attestation at SLSA Build Level 3, giving them the appearance of legitimate, signed releases. The campaign targets developers who install or update these packages, potentially exposing their credentials. No further details about the attacker or mitigation steps are provided.

AI summaries can be wrong sometimes—always verify important details using the source article.