HIGHSupply ChainOct 10, 2026 · 8 min
Shai-Hulud Supply Chain Attack
How a self-spreading npm worm turned stolen maintainer tokens into a cascading supply-chain compromise across hundreds of packages.
Tags / 2 posts
How a self-spreading npm worm turned stolen maintainer tokens into a cascading supply-chain compromise across hundreds of packages.
An exposed container registry with default credentials hands an attacker the entire software supply chain — images, secrets, source code.