AIThe New Stackabout 2 hours ago
Shai-Hulud Worm Alters 500 npm Packages
8 min read
A worm named Shai-Hulud altered over 500 npm package versions between September 14th and 18th, 2025, publishing new versions without maintainer action. The worm uploaded stolen credentials to a public GitHub repo named Shai-Hulud, demonstrating that controlling a package registry controls the software supply chain.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
