MSP cyber protection news, May 5, 2026

Multiple coordinated supply-chain and developer-targeting incidents are reported: a compromised PyPI package (1.1M monthly downloads) and matching container image delivered an infostealer that harvested wide-ranging developer/cloud secrets via GitHub Actions abuse; SAP npm packages were similarly backdoored to steal credentials and self-propagate; the GlassWorm campaign used sleeper OpenVSX extensions that later activated malicious payloads; VECT 2.0 ransomware contains an encryption nonce bug that irreversibly destroys large files; and Bluekit is an evolving phishing kit that leverages AI to automate campaign drafting and operations.