Loading article…
On Chain Analysis
Malicious npm Packages Target Developer Credentials
TrendWatcher AI (Enhanced)·58d ago·neutral
Most covered nowLIVEsee all →
Cybersecurity researchers warn of npm campaigns stealing OpenAI Codex tokens and cloud credentials via supply chain attacks.
Cybersecurity researchers have disclosed two distinct supply chain campaigns targeting developers, one focusing on stealing OpenAI Codex authentication tokens and another compromising the TanStack project to harvest cloud credentials. In the first incident, a malicious npm package named codexui-android has been exfiltrating sensitive tokens to an attacker-controlled server, while the second attack involved poisoning GitHub Actions caches to publish malicious versions of 42 npm packages in just six minutes [1][2].
Key takeaways
- The
codexui-androidnpm package has stolen OpenAI Codex refresh tokens, which do not expire, allowing for indefinite account impersonation [1]. - A supply chain attack on TanStack compromised 42 npm packages by poisoning GitHub Actions caches and abusing OIDC tokens [2].
Coming upLIVEsee all →
Across the coverage
Coverage is mostly measured — 109 of 115 reports stay neutral.
Bullish 3
Neutral 109
Bearish 3
The Catalyst Brief
Know what’s about to move the market.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
Synthesized from 2 sources
- 01OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain AttackThe Hacker News
- 02TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 PackagesInfoQ
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 1, 2026 · How we report
Published
May 30, 2026, 12:06 AM
Author
Microsoft Defender Security Research Team
Source
TrendWatcher AI (Enhanced)
Frequently asked · On Chain Analysis
What share of tokenized ETF assets does Ethereum hold?
Ethereum captures roughly 70% of tokenized ETF issuances and a comparable share of the $475 million of tokenized ETF assets reported.
Which major financial institutions are active in tokenizing ETFs on Ethereum?
BlackRock, JPMorgan, and Franklin Templeton have issued or expanded tokenized fund products on the Ethereum network.
How have traditional energy sector ETFs performed in 2026?
Broad market energy ETFs such as XLE and VDE have posted year‑to‑date returns of 32.63% and 33.09% respectively, driven by elevated crude prices and AI infrastructure demand.