Hackers Compromise Dozens of Open Source Packages in Supply Chain Attack
Cybersecurity firms reported that hackers took control of developer accounts and published malicious versions of widely used open source packages. The packages are relied on by software developers worldwide. The attack aims to steal credentials from downstream users.
medianama.comCybersecurity firms StepSecurity and SafeDep warned on Tuesday of an ongoing supply chain attack that has compromised dozens of popular open source packages. Hackers took over one developer account and released more than 630 malicious versions across 317 packages in roughly 20 minutes, according to SafeDep.
The packages are used by software developers around the world. The goal of the attack is to steal credentials for services including password managers, according to the firms. Malicious updates were also published on GitHub in some cases, JFrog Security reported.
One compromised package is Antv, a library developed by Alibaba. The current wave is part of a campaign researchers have named Mini Shai-Hulud. Last week, hackers compromised the computers of two OpenAI employees after gaining access through the open source library TanStack.
OpenAI was one of several victims in that wave. The attacks target open source projects and the developers who incorporate the code into their own applications.
Key Facts
Story Timeline
3 events- May 19, 2026
StepSecurity and SafeDep warn of latest wave of supply chain attacks.
1 source@techcrunch - May 19, 2026
Hackers release over 630 malicious versions across 317 packages in 20 minutes.
1 source@techcrunch - May 12, 2026
Hackers compromise computers of two OpenAI employees via TanStack library.
1 source@techcrunch
Potential Impact
- 01
Developers using the affected packages may receive malicious updates that steal credentials.
- 02
Organizations relying on open source code could face increased risk of data theft.
Transparency Panel
Related Stories
EuronewsWorld Urban Forum 2026 Draws 57,000 Participants from 176 Countries
The 13th World Urban Forum concluded with discussions on housing, climate resilience and urban governance. Organisers reported that the sessions informed future strategic priorities.
theverge.comTrump Mobile website still lists T1 phone as American-made
The product page for the T1 phone continues to describe the device as American-made. The Verge reported that the site may conflict with FTC advertising rules. The phone was announced in June 2025.
France 24EU Discusses Readiness for Artificial Intelligence Changes
A France 24 program examined whether European Union policies can address the effects of artificial intelligence. The discussion covered potential impacts across daily life and economic sectors.