Massive supply-chain attack compromises 440 packages under four hours

An attacker compromised a GitHub maintainer and rapidly deployed a Mini Shai-Hulud–based self-replicating worm that injected malicious code into hundreds of npm packages (initially keyv and related packages), ultimately affecting dozens of maintainers and over 860 packages with a combined ~2 billion monthly installs. The payload exfiltrates sensitive credentials (npm, GitHub, AWS, CI), AI-related config files, and crypto wallets; multiple security firms observed the same pattern and published IOCs, and attribution to a known actor (TeamPCP) is suspected but not fully confirmed.