A single npm user on Thursday published 14 malicious packages within a four hour window, all mimicking popular OpenSearch, Elasticsearch, DevOps, and environment configuration libraries, according to Microsoft. Its the latest in a seemingly never ending string of supply chain attacks targeting developer tools , and stealing cloud credentials and CI CD pipeline secrets in its wake. Using a newly created maintainer alias, vpmdhaj a39155771@gmail[.]com, the threat actor published 14 packages...
