Malicious npm packages abuse dependency confusion to profile developer environments

Reported 30 May 2026 by otx · Severity: medium

Microsoft Threat Intelligence identified an active supply chain attack involving malicious npm packages that employ dependency confusion techniques. Between May 28-29, 2026, a threat actor using three maintainer aliases published malicious packages across nine organizational scop