Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

A new supply-chain attack named Shai-Hulud has compromised hundreds of trojanized versions of popular npm packages, including Zapier, ENS Domains, PostHog, and Postman. These malicious packages were added to the npm registry to steal developer and CI/CD secrets, which are then encoded and posted on GitHub. As of the report, GitHub has identified 27,600 entries related to this attack.