🚨 A new NPM supply chain attack is currently underway, specifically targeting the AI ecosystem, including packages related to Mistral AI, OpenSearch, Guardrails AI, and others. It hooks into Claude and VS Code environments to steal user credentials, including GitHub tokens. What makes this attack especially sneaky is its persistence mechanism. It deploys scripts that monitor whether the compromised GitHub token gets revoked. The moment revocation is detected, the malware retaliates by wiping the user’s home directory. This punitive behavior both disrupts remediation efforts and buys attackers more time to deepen the compromise. We are entering a new era where attackers are becoming dramatically more capable, and defending against them is growing more difficult every day.