Shai-Hulud worm infects npm packages | Securelist

The self-propagating Shai-Hulud worm compromised over 500 npm packages—including widely used libraries—to steal sensitive data, expose private repositories, and hijack developer accounts, fueling a rapidly escalating supply chain attack across the open-source ecosystem.