The Streak Continues: Four More Supply Chain Attacks Hit npm and PyPI
Between early June and July 14, four more supply chain attacks hit npm and PyPI: a Shai-Hulud worm variant, typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline. Different entry points, one target: the credentials in developer environments and build pipelines.
By Cybersecurity research team • 22 Jul 2026 • 5 min read
Between early June and July 14, 2026, four more supply chain attacks hit npm and PyPI.
The Miasma worm we flagged in our last post did not stop at Red Hat's packages. It kept spreading across npm through June 5, reaching the Vapi server SDK and a string of smaller packages before researchers finished counting. Miasma was not the only worm working in that window. In early June, JFrog uncovered IronWorm, a Rust-built infostealer planted in 36 npm packages that hid behind an eBPF kernel rootkit and spread by using stolen npm credentials to publish trojanized versions of its victims' packages. That campaign was stopped before it reached widely used packages. Four more attacks followed. A PyPI sibling, two typosquat and credential-theft campaigns, and a CI token theft that backdoored packages with millions of weekly downloads. Different entry points, one objective: land where the credentials live and leave with them.
