Shai-Hulud 2.0: The NPM Worm That’s Eating the Software Supply Chain
Executive Summary In what security experts are calling one of the most severe JavaScript supply chain attacks in history, a self-propagating worm dubbed “Shai-Hulud 2.0” has compromised over 25,000 GitHub repositories and 700+ npm packages with a combined download count exceeding 100 million. The attack, which began on November 21, 2025, represents a dangerous evolution
Read More