640 NPM Packages Infected in New ‘Shai-Hulud’ Supply Chain Attack

A new variant of the Shai-Hulud self-replicating worm has infected approximately 640 NPM packages, escalating from a previous attack that compromised over 180 packages. The worm exploits NPM tokens and uses preinstall scripts for propagation, significantly increasing its spread across development environments. It drops malicious files, hijacks DNS, and can delete user data if no tokens are found.

Over 25,000 malicious repositories have been identified, with the worm capable of infecting up to 100 packages per victim. Major packages from companies like Zapier and Postman have been affected, leading to a combined monthly download count exceeding 130 million. Security experts recommend organizations to scan for indicators of compromise, rotate secrets, and enforce strict access policies to mitigate risks.