Supply Chain Attack Targeting Several NPM Packages to Harvest Credentials

A coordinated NPM supply-chain campaign (Shai-Hulud) trojanized more than 40 packages — including packages published under a CrowdStrike account — by injecting a malicious bundle.js executed on npm install to harvest GitHub, AWS, GCP, Azure, and NPM credentials, propagate by forcing republishing of packages, and persist via malicious GitHub Actions that exfiltrate secrets to a webhook; affected packages were removed and the report provides IoCs, hunting queries, and mitigation guidance.