Mini Shai-Hulud Attack Prompts npm to Revoke 2FA-Bypass Tokens

npm invalidated all write-enabled tokens that bypass 2FA and released a staged-publishing preview after the 'Mini Shai-Hulud' supply-chain campaign (attributed to TeamPCP) compromised hundreds of packages across npm, PyPI, and Composer. Attackers republished malicious versions by hijacking maintainer accounts, abusing CI/CD pipelines (including GitHub Actions cache poisoning and extracting OIDC tokens), and even spreading via a malicious VS Code extension that exfiltrated data from thousands of repositories; the report emphasizes rotating credentials, restricting CI token exposure, and adopting staged publishing to mitigate further supply-chain risk.