Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)
350 points by theanonymousone | 272 comments
SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.
#shai-hulud on Hacker News
6 stories tagged shai-hulud, newest first.
Postmortem: TanStack NPM supply-chain compromise(tanstack.com)
1047 points by varunsharma07 | 435 comments
GitHub issue on TanStack Router reporting that several latest npm releases are potentially compromised, linking to a StepSecurity analysis of a self-spreading supply-chain attack.
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library(semgrep.dev)
450 points by j12y | 172 comments
Semgrep security research post reporting that PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with Shai-Hulud themed credential-stealing malware.
SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM(aikido.dev)
317 points by birdculture | 98 comments
Aikido Security blog post reporting a second Shai Hulud npm supply-chain attack compromising packages from Zapier, ENS, AsyncAPI, PostHog, and Postman.
Shai-Hulud Returns: Over 300 NPM Packages Infected(helixguard.ai)
967 points by mrdosija | 733 comments
HelixGuard blog post reporting that the Shai-Hulud worm returned, infecting over 300 npm packages via a fake Bun runtime within hours.
Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised(socket.dev)
1182 points by jamesberthoty | 965 comments
StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.