Microsoft Investigating New Mini NPM Supply Chain Attack - Tekedia

Microsoft is investigating a new npm supply chain attack dubbed Mini Shai-Hulud.

The campaign may have inserted malicious hooks into AntV packages, with possible credential compromise and transitive dependency poisoning.

The case highlights how one compromised open-source package can spread malicious code across downstream applications.

It underscores growing security risks in JavaScript supply chains for enterprises and CI/CD pipelines.