The attacks are part of a wider campaign known as Mini Shai-Hulud, which has already compromised several open source projects and, in turn, developers and companies that use them.

3 campaigns hit npm, PyPI, and Docker Hub in 48 hours, exposing secrets from developer and CI/CD environments.

Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings