MSC-2026-6195

Shai-Hulud supply-chain malware payload distributed through compromised npm packages in the Leo/RStreams ecosystem. The payload steals developer credentials the moment a package is installed, harvesting GitHub tokens and CLI credentials, npm and PyPI publishing credentials, AWS access keys and...

PYSEC-2026-207 durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account

durabletask versions 1.4.1, 1.4.2, and 1.4.3 were published on 2026-05-19 within a 35-minute window through a compromised PyPI maintainer account and contained malicious code. On import, the package fetched a remote payload rope.pyz from an attacker-controlled host and executed it. The payload wa...