Microsoft discovers new npm attack in 14 packages

Microsoft found 14 malicious npm packages uploaded from a new account on May 28, posing as OpenSearch and Elasticsearch tools.

The packages used install-time hooks and a second-stage loader to steal system data and secrets from AWS, HashiCorp Vault, GitHub Actions, npm, and related environments.

Microsoft and npm removed the packages, and organizations should audit builds and rotate any exposed credentials.

The incident highlights how compromised developer packages can give attackers access to cloud secrets, CI/CD tokens, and source code.