New Shai-Hulud malware wave compromises 600 npm packages

The Shai-Hulud supply-chain campaign published hundreds of malicious npm package versions (over 600 packages / 323 unique packages reported) to steal developer and CI/CD secrets, exfiltrating data via a Session P2P network and GitHub repositories; the malware is obfuscated, encrypts stolen data, can self-propagate by republishing infected packages, and abuses OIDC tokens to create apparently valid Sigstore provenance attestations.