Hackers Compromise Dozens of Open Source Packages in Supply Chain Attack

Cybersecurity firms StepSecurity and SafeDep warned on Tuesday of an ongoing supply chain attack that has compromised dozens of popular open source packages. Hackers took over one developer account and released more than 630 malicious versions across 317 packages in roughly 20 minutes, according to SafeDep.

The packages are used by software developers around the world. The goal of the attack is to steal credentials for services including password managers, according to the firms. Malicious updates were also published on GitHub in some cases, JFrog Security reported.

One compromised package is Antv, a library developed by Alibaba. The current wave is part of a campaign researchers have named Mini Shai-Hulud. Last week, hackers compromised the computers of two OpenAI employees after gaining access through the open source library TanStack.

OpenAI was one of several victims in that wave. The attacks target open source projects and the developers who incorporate the code into their own applications.