Investigating Shai-Hulud: Inside the NPM Supply Chain Worm | The Sequence

The Shai-Hulud malware campaign weaponized NPM package supply chains and GitHub Actions workflows to self-propagate, steal sensitive credentials, and covertly establish persistent backdoors across developer environments, posing a systemic risk to the entire software ecosystem.