Typosquatted npm Packages Harvest Cloud and CI/CD Secrets, Microsoft Finds
Microsoft identified a supply‑chain attack where a threat actor published 14 malicious npm packages that typo‑squat popular OpenSearch and Elastic libraries. The packages execute a preinstall hook to steal AWS credentials, HashiCorp Vault tokens, CI/CD pipeline secrets, and npm publish tokens for further exploitation.