Active npm supply chain attack distributing a coordinated wave of credential-stealing packages published June 4, 2026 from a shared publisher infrastructure using <scope>-<6char>@wshu.net emails. The packages drop a Chromium browser credential stealer that decrypts and exfiltrates saved cookies and logins over HTTPS, delivered through obfuscated postinstall hooks. All listed versions across 14 scoped packages are attacker-controlled and should be treated as compromised.