Shai-Hulud was the best thing to happen to supply chain security

This report documents a sustained, evolving supply-chain campaign that weaponized npm publishing and CI pipelines—starting from phishing and long-lived token theft and escalating to Pwn Requests, runner-memory OIDC extraction, and direct abuse of OIDC endpoints—resulting in thousands of compromised repositories and hundreds of malicious package releases across npm and other ecosystems; adoption of npm Trusted Publishing rose only after high-impact waves forced behavior change.