Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack

Attackers compromised a developer account and pushed hundreds of malicious package versions across more than 300 open source packages.

The campaign aims to steal developer credentials and spread malware through trusted dependencies.

Researchers linked the incident to the ongoing Mini Shai-Hulud supply chain campaign.

Security firms including StepSecurity, SafeDep, and JFrog Security warned the impact could spread quickly to downstream users.