Typosquatted npm Packages Steal Cloud and CI/CD Secrets

Gbhackers •Mayura Kathir • May 29, 2026

A coordinated npm supply chain attack has been uncovered targeting developers working with OpenSearch, ElasticSearch, and DevOps tooling, with attackers actively stealing cloud credentials and CI/CD secrets from infected systems. The malicious packages imitate legitimate libraries by using lookalike names such as opensearch-setup and elastic-opensearch-helper, while falsely linking to the official OpenSearch GitHub repository in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Supply Chain Attack: Typosquatted npm Packages Compromise Developer Credentials A coordinated attack has been identified targeting npm packages, specifically those mimicking legitimate libraries like opensearch-setup and elastic-opensearch-helper. Developers using OpenSearch, ElasticSearch, and various DevOps tools are at risk, as these malicious packages are designed to steal cloud credentials and CI/CD secrets. The attack was uncovered on May 28, 2026, highlighting vulnerabilities in the open-source software supply chain. Attackers are exploiting the ease of creating lookalike package names to infiltrate developer environments. The incident raises significant concerns about the security of software dependencies in development workflows. Security professionals are urged to review their package dependencies and implement monitoring for suspicious activities. The full scope of the attack and the number of affected systems is still being assessed. 3 sources 66

Extracted Entities

Typosquatted npm Packages Steal Cloud and CI/CD Secrets

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (2)