MEDIUMSupply Chain
Global

Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks

·Source: SecurityWeek

Updated:

Executive Summary

The most recent variants of the self-propagating attacks are named Miasma and Hades. The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek .

Analysis

The most recent variants of the self-propagating attacks are named Miasma and Hades. The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek .
Source Attribution

Originally published by SecurityWeek on Jun 9, 2026.

Related Threats

MEDIUMSupply Chain

GitHub to Update npm to Thwart Software Supply Chain Attacks

NPM, part of GitHub, announced a new version of the npm package manager with several security improvements, including disabling install scripts

Infosecurity Magazine
MEDIUMSupply Chain

Atomic Arch npm Campaign Adds Malicious Dependency

<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/atomic-arch-npm-campaign-adds-malicious-dependency" title="" class="hs-featured-image-link"> <img src="https://www.sonatype.com/hubfs/RapidResponse_Templates_Malware%20%284%29.png" alt="Atomic Arch" class="hs-featured-image" style="width:auto !important; max-width:50%; float:left; margin:0 15px 15px 0;"> </a> </div> <p>

Sonatype (Maven/npm)
MEDIUMSupply Chain

ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories

It's been one of those weeks. You expect the usual noise: recycled malware, sloppy attacks, another easy target getting hit. Instead, there's a supply chain attack kit in a public repo, a $5,000-a-month RAT that clones browsers, and research showing AI agents can be tricked into leaking real credentials. The bigger problem is how polished this all looks now. Mule networks run like SaaS.

The Hacker News