- 27th November 2025
The Shai Hulud campaign marks a major escalation in npm supply chain attacks. This article examines how the malware executes during preinstall, steals cloud and CI/CD secrets, injects GitHub workflows, attempts container breakout, and propagates across nearly 700 compromised packages. The full timeline tracks the attack from the first September incidents through the November V2 expansion.
Francesco Cipollone
