Massive Malicious NPM Package Attack Threatens Software Supply Chains

### Executive Summary: The Shai-Hulud campaign is an active, worm-like supply-chain attack that trojanized over 700 NPM packages (including high-profile packages) to execute a bundle.js payload which runs credential discovery tools, steals developer and CI/CD tokens, and creates persistent GitHub Actions workflows to exfiltrate secrets to hard-coded webhooks; Recorded Future provides technical analysis, IOCs, and mitigation recommendations including removing compromised package versions, rotating tokens, and auditing CI/CD and repository workflows.