Shai-Hulud Returns with ‘Golden Path’ Malware in Latest NPM Supply Chain Attack

Researchers at Aikido detected a new strain of the Shai-Hulud worm—dubbed “The Golden Path”—embedded in an npm package; the variant improves cross-platform propagation, harvests cloud credentials via TruffleHog, exfiltrates data to GitHub repositories, and is linked to prior high-impact supply-chain campaigns (including theft and a destructive dead-man’s switch).