Socket Security

Socket Security researchers discovered that malicious PyPI packages in the Hades wave of the Mini Shai-Hulud/Miasma supply chain campaign embed fake CBRN-themed text in JavaScript block comments to tr…

On May 11, 2026, a coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions, targeting major projects including the entire TanStack router…