Shai-Hulud: Whoever controls your package registry controls your pipeline

The New Stack · 1 month ago · 36

npm’s registry became self-updating as the Shai-Hulud worm automatically republished new package versions without any maintainer action. Between September 14 and September 18, more than 500 package versions were altered, and a later variant backdoored 796 packages. The takeaway is that teams must change supply-chain defenses—pin immutable dependencies, use curated allow-listed registries, scope/shorten credentials, and restrict egress—because provenance and attestations can be bypassed when an attacker compromises the publish pipeline.