Shai-Hulud Worm Strikes npm Packages — 132M Downloads Affected

The Shai-Hulud worm has compromised over 800 npm packages, affecting 132 million monthly downloads. This sophisticated attack occurred just before npm's deadline to revoke classic tokens, targeting developers unprepared for the transition. The worm uses TruffleHog to scan for exposed secrets and publishes them to a public GitHub repository. It also attempts to propagate itself by publishing malicious copies to npm, potentially causing widespread damage. Major technology organizations, including AsyncAPI and PostHog, have been affected, highlighting the need for better secret management and active threat monitoring.