Active Malware Campaigns in January-May 2026

### Executive Summary: This report documents multiple active 2026 software supply-chain campaigns—notably DPRK-linked Lazarus Group operations (Contagious Interview, TasksJacker/PolinRider) and financially motivated TeamPCP (CanisterWorm, Mini Shai-Hulud)—that used malicious .vscode/tasks.json files, lifecycle hooks, self‑propagating worms, and credential‑stealing payloads to compromise developers, CI runners, package registries (npm, PyPI), and container images, resulting in widespread token and secret exfiltration and large-scale package poisoning.