SHAI-HULUD NPM WORM RETURNS, POISONING OVER 1,280 NPM PACKAGES

Summary from the TLDR InfoSec newsletter

A new Shai-Hulud worm variant has compromised over 1,280 npm packages, including the well-known Keyv library, by injecting malicious commits via hijacked GitHub Actions pipelines. The worm employs a preinstall hook to download Bun and run an obfuscated payload that aggressively extracts developer and cloud credentials such as AWS, Kubernetes, and Vault, which it then uses to spread further. Organizations that have installed affected versions should assume an immediate breach, requiring them to rotate all secrets immediately and perform manual log reviews, rather than waiting for scheduled vulnerability scans.