dependency confusion

Microsoft Threat Intelligence disclosed on May 29, 2026, that malicious npm packages published on May 28 and May 29 under three maintainer aliases used dependency confusion across nine organizational scopes to impersonate internal corporate modules and run obfuscated reconnaissance code during...