Self-propagating supply chain attack hits 187 npm packages

Security researchers attribute a large, active npm supply-chain campaign called 'Shai-Hulud' that began with compromise of @ctrl/tinycolor and has expanded to at least 187 packages, including packages under CrowdStrike's npm namespace. Compromised releases include a bundle.js that downloads and runs TruffleHog to locate developer and CI secrets, validates credentials, creates malicious GitHub Actions workflows, exfiltrates data to a hardcoded webhook, and automatically repackages and republishes infected packages to propagate further; users are advised to audit environments, rotate secrets and CI tokens, and pin dependencies.