Shai-Hulud worm returns stronger and more automated than ever before

Security researchers have identified an ongoing supply-chain campaign using a Shai‑Hulud worm that trojanized nearly 500 npm packages and exposed developer tokens, impacting more than 26,000 GitHub repositories; the malware steals credentials, uses stolen npm tokens to propagate automatically, creates malicious preinstall artifacts and public repos with stolen data, and has been observed downloading to real environments before package removal, increasing the likelihood of downstream exploitation.