Fourteen npm typosquats target cloud and build credentials

Microsoft reported that an actor published 14 malicious npm packages within a four-hour period on 28 May. Their names resembled established search, DevOps and environment-configuration libraries. Some metadata pointed toward a legitimate upstream project, making the package appear more credible.

Researchers described installation-time execution followed by a payload that collected cloud, Vault and CI/CD secrets. Stolen publishing credentials could also place downstream software at risk. The investigation concerns the identified packages and execution chain, rather than every library with a similar name. For maintainers reviewing exposure, the package version and installation history matter alongside the credentials available to the process at that time.