Shai-Hulud: The novel self-replicating worm infecting hundreds of NPM packages

Sysdig TRT discovered an active NPM supply-chain worm dubbed Shai-Hulud that executes as a package post-install script (bundle.js), harvests GitHub/NPM/AWS/GCP credentials (including via IMDS), exfiltrates them (e.g., to webhook.site), makes private GitHub repos public (creating copies with a "-migration" suffix), and self-propagates by using maintainer credentials and NPM APIs to update other packages; ~200 infected packages were observed and the report provides detection mappings for Sysdig Secure and Falco plus remediation guidance (package rollbacks, credential rotation, runtime controls).