Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials

The report documents a series of supply‑chain intrusions (S1ngularity, Shai‑Hulud, TeamPCP) that used stolen publishing tokens and manipulated CI/CD workflows to deliver credential‑stealing malware and a self‑propagating worm through trusted package updates, compromising developer machines, repositories, and cloud resources; it lists SHA‑1 IoCs, a malicious repository name, and provides mitigation guidance such as short‑lived tokens, limited permissions, and CI pinning.