What We Know About the NPM Supply Chain Attack

This TrendAI research blog details a large-scale NPM supply-chain attack where attackers phished a package maintainer, injected malicious code into popular JavaScript packages, and deployed a self-propagating worm called Shai-Hulud that abuses post-install scripts and GitHub workflows to exfiltrate secrets, clone and publish private repositories, and deliver cryptojacking payloads; the report describes observed infection mechanics, use of TruffleHog for credential harvesting, initial telemetry (including ~500 impacted packages and cryptojacker reports), and recommended mitigations such as auditing dependencies, rotating credentials, and enforcing MFA.