Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPI

The Shai-Hulud: Here We Go Again campaign by TeamPCP is a highly sophisticated, worm-like supply chain attack that compromised over 170 npm and PyPI packages—spreading automatically through CI/CD environments, stealing credentials, and using destructive persistence mechanisms that threaten to wipe developer machines if defenders revoke stolen GitHub tokens before fully eradicating the malware.