Infamous Shai-hulud Worm Resurfaces From the Depths

A new, more dangerous variant of the Shai-hulud self-replicating worm is actively infecting open-source repositories (notably NPM), impacting over 25,000 repositories and compromising popular packages; it executes malicious code during the preinstall phase to steal credentials (GitHub, Azure, AWS, GCP, NPM) and, if theft/exfiltration fails, can delete writable files under the victim's home directory, indicating both long-term persistence goals and punitive sabotage.