Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack

A recent series of cyberattacks has struck numerous widely-used open source projects that software developers depend on globally. Cybersecurity firms StepSecurity and SafeDep issued alerts on Tuesday regarding this ongoing supply chain attack, designed to infiltrate developers of popular open source initiatives. The attackers managed to hijack the account of a developer, releasing over 630 malicious updates across 317 different packages in a mere 20 minutes. This alarming tactic aims to capture credentials for various services, including password managers, thereby facilitating data theft and further malware dissemination. Among the affected packages is Antv, a library developed by Alibaba. Reports from JFrog Security indicate that the hackers even published some of these harmful updates on GitHub. This incident is part of a broader trend of assaults targeting open source projects and the developers who incorporate this code into their systems. Researchers have named these incidents “Mini Shai-Hulud,” referencing a previous, more extensive hacking campaign. Just last week, in a related series of attacks, cybercriminals compromised the computers of two OpenAI employees after breaching the open source library, TanStack. OpenAI was notably one of several organizations impacted by these malicious activities.