No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and Docker Hub in 48 Hours

After a few quieter weeks, three supply chain attacks put secrets back in the spotlight. Between April 21 and 23, 2026, three distinct attacks hit npm, PyPI, and Docker Hub simultaneously. Their targets differ and the threat actor groups might, but their objectives don't: in each case, the malware's primary goal was to steal secrets from developer environments and CI/CD pipelines . API keys, cloud credentials, SSH keys, and registry tokens were all targeted. Campaign 1 - Checkmarx KICS: Compromi