Hackers can bypass npm’s Shai-Hulud defenses via Git dependencies

Researchers discovered multiple vulnerabilities (PackageGate) in JavaScript package managers that let Git-based dependencies override configuration (e.g., .npmrc) and execute arbitrary code even when lifecycle scripts are disabled; fixes were released for Bun, pnpm and vlt, but npm dismissed the report, raising significant supply-chain and code-execution risk tied to past Shai-Hulud malware activity.