HACKERS CAN BYPASS NPM'S SHAI-HULUD DEFENSES VIA GIT DEPENDENCIES

Summary from the TLDR InfoSec newsletter

Researchers discovered "PackageGate" vulnerabilities in JavaScript package managers that allow bypassing npm's '--ignore-scripts' defense via malicious .npmrc files in Git dependencies, with pnpm, vlt, and Bun issuing patches while npm rejected the report as expected behavior.