Supply Chain Attack: Typosquatted npm Packages Compromise Developer Credentials

A coordinated attack has been identified targeting npm packages, specifically those mimicking legitimate libraries like opensearch-setup and elastic-opensearch-helper. Developers using OpenSearch, ElasticSearch, and various DevOps tools are at risk, as these malicious packages are designed to steal cloud credentials and CI/CD secrets. The attack was uncovered on May 28, 2026, highlighting vulnerabilities in the open-source software supply chain. Attackers are exploiting the ease of creating lookalike package names to infiltrate developer environments. The incident raises significant concerns about the security of software dependencies in development workflows. Security professionals are urged to review their package dependencies and implement monitoring for suspicious activities. The full scope of the attack and the number of affected systems is still being assessed.

Key Points: • Malicious npm packages are impersonating legitimate libraries to steal credentials. • Developers using OpenSearch and ElasticSearch are particularly at risk. • The attack was uncovered on May 28, 2026, emphasizing supply chain vulnerabilities.