Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit
· Source: securityweek.com
In short
A self-replicating worm, dubbed Shai-Hulud, has compromised over 180 NPM packages to steal secrets and publish them to public GitHub repositories. The attack uses compromised developer accounts to inject malicious code that exfiltrates credentials and automates the propagation of the infection. This is described as one of the most severe JavaScript supply-chain attacks observed to date, impacting a wide range of organizations and developers.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 38, 2025: Agentic AI Drives Autonomous Supply Chains with Measurable Cost and Speed Gains
Tags: security, supply-chain, cybersecurity, automation, vulnerability, malware