A supply-chain attack has compromised over 400 npm packages, exploiting vulnerabilities to steal developer credentials, as reported by Microsoft Threat Intelligence. The malicious packages, which include a variant of the Mini Shai-Hulud worm, impact widely used JavaScript software. This situation raises significant security concerns for developers in the npm ecosystem.