HOW WE GOT HIT BY SHAI-HULUD: A COMPLETE POST-MORTEM

Summary from the TLDR InfoSec newsletter

Shai-Hulud 2.0 is a malicious npm supply-chain worm that abuses install-time scripts to run hidden malware on developer machines, steal credentials with tools like TruffleHog, and then exfiltrate them to attacker-controlled GitHub repositories using obfuscation techniques such as multi-layer base64 encoding. With stolen tokens, it can mass-clone private code, attempt destructive git operations, and, if npm publish credentials exist, automatically republish trojanized versions of popular packages, rapidly propagating through the JavaScript ecosystem. Recommendations to prepare against it include disabling npm scripts by default, adopting pnpm's safer defaults and minimum package age, enforcing branch protection everywhere, and moving to short-lived CI-based publishing via OIDC to eliminate long-lived secrets on developer laptops.