Two active malware campaigns are targeting enterprise Windows endpoints and software development pipelines simultaneously. The TamperedChef operation has distributed 4,000+ malware samples hidden inside trojanized productivity applications that delay malicious activity for weeks to evade detection, while the Shai-Hulud 2.0 npm worm has compromised tens of thousands of GitHub repositories, stealing credentials and destroying developer environments when theft fails. Organizations running the affected productivity apps or consuming open-source npm packages face credential theft, remote access compromise, and potential data destruction, with a secondary risk that compromised developer systems become entry points into broader enterprise infrastructure.