MSC-2026-6195

Shai-Hulud supply-chain malware payload distributed through compromised npm packages in the Leo/RStreams ecosystem. The payload steals developer credentials the moment a package is installed, harvesting GitHub tokens and CLI credentials, npm and PyPI publishing credentials, AWS access keys and...