Shai‑Hulud Worm Hijacks 1,300 npm Packages, Exposes 2 Billion Installations
Attackers compromised the maintainer of the popular keyv library, used stolen tokens to push signed malicious releases, and now the worm is infecting over 1,280 npm packages that together see more than 2 billion installs each month. It silently harvests GitHub, AWS, Kubernetes, Slack and other secrets, spreading to fresh packages every few minutes.