Hackers Compromise 170 npm Packages to Steal GitHub, npm, AWS, and Kubernetes Secrets

A coordinated supply-chain campaign attributed to TeamPCP compromised over 170 npm and two PyPI packages to deploy credential‑stealing, self‑propagating malware that abuses GitHub Actions/workflows to harvest and exfiltrate secrets via GitHub dead‑drop repositories and includes a dead‑man wiper; the report provides extensive IoCs and remediation guidance.