Back Kucoin

Supply chain attack targets crypto and AI developers via npm/PyPI/crates.io

Kucoin • May 25, 2026

Huo Xing Cai Jing reports that, according to SlowMist, the security firm MistEye detected a supply chain attack targeting registries. Attackers distributed malicious packages to npm, PyPI, and crates.io, targeting developers in the cryptocurrency, DeFi, Solana, Sui/Move, and AI sectors. The attack involved over 34 malicious packages and more than 384 associated versions. The attackers may have stolen cryptocurrency wallets, SSH keys, cloud credentials, GitHub/AWS tokens, browser data, environment variables, and other developer secrets. Some malicious payloads also attempted to achieve persistent persistence via .cursorrules, CLAUDE.md, Git hooks, shell hooks, cron, systemd, and SSH. Developers are advised to immediately remove affected packages, isolate compromised systems, retain logs, rotate exposed credentials, rebuild CI environments and developer machines from clean images, and review activity logs for GitHub, cloud services, SSH, and wallet access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 753 sources 71

Extracted Entities

Supply chain attack targets crypto and AI developers via npm/PyPI/crates.io

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (2)

Tools (1)