Researchers from multiple security firms observed a variant of Mini Shai-Hulud, self-replicating malware linked to TeamPCP, in all the affected packages.

The campaign hit major registries and hid behind legitimate-looking release signatures, showing how attackers can weaponize the software update process itself.