Another wave of the Shai-Hulud campaign has targeted npm with over 500 malicious packages and 700+ versions affected. PostHog published a detailed post-mortem revealing how their GitHub Actions workflow was compromised as an initial access vector. An attacker briefly opened a pull request that modified a script executed via GitHub Actions, demonstrating sophisticated supply chain attack techniques. This represents a significant escalation in the ongoing Shai-Hulud malware campaign targeting the JavaScript ecosystem. The attack shows continued evolution in npm-based supply chain threats.