MSC-2026-6196

Malicious code in @immobiliarelabs npm packages Miasma Mini Shai-Hulud supply-chain attack. Twenty-two @immobiliarelabs-scoped packages backstage-plugin-gitlab, backstage-plugin-gitlab-backend, backstage-plugin-ldap-auth, backstage-plugin-ldap-auth-backend were compromised. The malware uses a...

MSC-2026-6098

Coordinated npm supply-chain worm wave, June 3-4 2026. An attacker published 58 packages 287 malicious versions within roughly a two-hour window, each triggering a self-replicating credential stealer through a binding.gyp native-build install hook Phantom Gyp instead of a postinstall script -...