ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories

The ThreatsDay bulletin highlights a major npm worm incident, with the Shai-Hulud 2.0 campaign exposing around 400,000 unique raw secrets after compromising over 800 packages and publishing stolen data to about 30,000 GitHub repositories.

Wiz said the dominant infection vectors are the postman/tunnel-agent-0.6.7 package and the asyncapi/specs-6.8.3 package, together accounting for over 60% of infections, as the self-spreading worm stole cloud credentials to access cloud-native secret management services and could wipe data if propagation failed. The report notes the initial access vector was abuse of pull_request_target via PWN in the CI/CD workflow configuration.

In addition to the npm-focused campaign, the ThreatsDay rundown covers a broad slate of stories, including DeFi exploits, phishing campaigns, and malware updates spanning anti-forensic packs, AI-enabled tools, and supply-chain threats. The piece underscores how these diverse attacks continue to threaten money, data, and trust, urging vigilance across developers, organisations, and individuals.

According to Wiz, the scale and methods of the npm incident illustrate the increasingly intertwined nature of software supply chains and credential theft.