TLDR Tech / InfoSec
Shai-Hulud: Whoever Controls Your Package Registry Controls Your Pipeline
The npm worm lineage, specifically the August 2026 ChainDrop campaign, has demonstrated that traditional supply chain provenance mechanisms are insufficient. Threat actors compromised over 400 packages in four hours by hijacking a maintainer's legitimate signed release pipeline, resulting in poisoned packages with valid SLSA attestations. The campaign also used an Ethereum smart contract for command and control to evade domain blocklists. This attack, evolving from previous Shai-Hulud worms, now targets authentication tokens for AI development tools. Security researchers caution that similar tactics could compromise infrastructure-as-code pipelines, highlighting that current attestation models verify origin, not code legitimacy. Defenses include strict version pinning, curated registries, OIDC-scoped credentials, and aggressive network egress restrictions.
Read the full story