Shai-hulud supply chain attack: Don’t let worms eat DevOps

The article describes the Shai-hulud worm: a fast-spreading, self-replicating supply-chain malware that compromised more than 360 npm packages (including widely downloaded ones), propagated via compromised maintainer accounts, scanned repositories for developer secrets, and abused the GitHub API and Actions to expose and exfiltrate non-public code and secrets. It reviews GitHub's planned security changes (FIDO-based 2FA, limited granular tokens, trusted publishers), advocates for registry "break glass" protections, SBOMs, artifact provenance, deferred updates, and behavioral detection to improve software supply-chain resilience.