Maintenance in progress

a self-propagating worm called shai-hulud spread through more than 400 npm software packages across 1700+ versions, harvesting credentials from developer machines, build pipelines, cloud accounts and secret vaults, then republishing infected packages with the stolen tokens. its command channel reportedly uses ethereum smart contracts and github messages, which makes takedown harder than a normal server-based operation. in the same cycle a new ransomware group, orova, appeared with 24 victims across six countries, and cisa flagged active exploitation of a critical jetbrains teamcity flaw in build servers.

software supply-chain research