Shai-hulud: The Hidden Cost of Supply Chain Attacks

The report summarizes recent large-scale supply-chain attacks against open-source component ecosystems—including self-replicating NPM worms and credential-stealing malware—that poisoned many packages and repositories. While defenders and registries mitigated many waves quickly, the campaigns risked credential exposure, downstream code tampering, and long-term access abuse, imposing direct and substantial indirect costs on organizations and developer workflows.