Shai-Hulud Worm Turns npm Publishing Into a Supply-Chain Attack

AI summary

The article describes a series of self-propagating npm supply-chain attacks, starting with Shai-Hulud and later variants that stole credentials, republished poisoned packages, and spread without human action. The latest variant, ChainDrop, abused a legitimate signed release pipeline and valid SLSA attestations to bypass trust checks, while also using an Ethereum smart contract for command infrastructure.