Typosquatted npm Packages Used to Steal Cloud and CI/CD Secrets: A Wake-Up Call for Software Supply Chains
The software supply chain is under attack once again. Microsoft Threat Intelligence recently uncovered a malicious campaign where attackers published typosquatted npm packages designed to steal cloud credentials, CI/CD secrets, and developer environment information. This incident highlights how a simple typo can lead to a major security breach affecting organizations worldwide
What Happened?
On May 28, 2026, Microsoft identified a threat actor operating under a newly created npm maintainer account that published 14 malicious packages within a few hours. These packages impersonated legitimate and widely used libraries related to OpenSearch, Elasticsearch, DevOps tooling, and environment configuration management.
The attackers relied on a technique known as typosquatting, where malicious packages are given names that closely resemble legitimate packages. Developers who accidentally install the wrong package unknowingly execute malicious code.
Why This Attack Is Dangerous
Unlike traditional malware attacks targeting end users, this campaign focused on developers and build environments.
The malicious packages were designed to collect:
1. Cloud provider credentials
2. CI/CD pipeline secrets
3. GitHub tokens
4. Environment variables
5. Infrastructure configuration data
Once attackers gain access to these assets, they can:
1. Access cloud environments
2. Modify production workloads
3. Inject malicious code into software releases
4. Move laterally across enterprise systems
5. Launch broader supply chain attacks
This makes software developers and DevOps teams prime targets for cybercriminals.
How Typosquatting Works
Imagine a developer intends to install:
1npm install opensearch-client
But accidentally types:
1npm install opensearch-cllent
The second package could be a malicious lookalike controlled by an attacker.
Since npm packages can execute scripts during installation, malicious code can run immediately after installation without additional user interaction
The attack didn't need to be clever. It just needed you to be in a hurry.
The Growing Trend of Supply Chain Attacks
This incident is not isolated.
Throughout 2026, security researchers have observed multiple npm and open-source ecosystem attacks targeting:
1. GitHub Actions
2. Cloud credentials
3. Developer workstations
4. Build pipelines
Open-source maintainers
Recent campaigns such as Mini Shai-Hulud, Megalodon, and dependency confusion attacks demonstrate that attackers are increasingly focusing on software supply chains rather than traditional endpoints.
How Organizations Can Protect Themselves
1. Implement Dependency Monitoring
Continuously scan third-party packages before they enter development environments.
2. Verify Package Authenticity
Always validate:
Package names
Maintainer reputation
Repository links
Download history
3. Enforce Least-Privilege Access
Limit permissions for:
Cloud accounts
CI/CD pipelines
Service accounts
Developer credentials
4. Monitor Secret Exposure
Continuously detect exposed:
API keys
Tokens
Certificates
Cloud credentials
5. Secure Build Pipelines
Protect CI/CD environments from unauthorized package installations and suspicious dependencies.
6. Enable Runtime Monitoring
Detect unusual package behavior such as:
Environment variable harvesting
Network exfiltration attempts
Unauthorized script execution
How vigilnz Helps
Solutions like vigilnzAgentSecure and vigilnz SDLC Security can help organizations strengthen software supply chain security by:
1. Identifying malicious dependencies
2. Monitoring developer environments
3. Detecting secret leakage
4. Securing CI/CD pipelines
Providing continuous security validation throughout the SDLC
Reducing risks from open-source package abuse
Conclusion
The recent typosquatted npm package campaign serves as another reminder that software supply chains remain one of the most attractive attack surfaces for cybercriminals. A single mistaken package installation can expose cloud credentials, compromise CI/CD pipelines, and create a pathway into an organization's critical infrastructure. Organizations must adopt proactive dependency management, continuous monitoring, and secure development practices to stay ahead of evolving supply chain threats.