New Shai-Hulud Worm Spells Trouble For npm Users

Security researchers report an active secret-stealing worm called Shai-Hulud 2.0 infecting npm packages: attackers hijack maintainer accounts to publish trojanized packages that exfiltrate secrets (AWS keys, GitHub tokens) to attacker-controlled GitHub repos and propagate by creating malicious versions of other packages. Multiple vendors report hundreds to 700+ infected packages with tens to hundreds of millions of downloads and extremely rapid scaling, and experts recommend auditing dependencies, rotating secrets, disabling postinstall scripts in CI, pinning versions, and enforcing MFA.