The Shai-Hulud worm has compromised a third major npm package, intercom-client@7.0.4, with 361,510 weekly downloads. This follows the compromise of mbt@1.2.48 and @cap-js/sqlite@2.2.2 packages 29 hours earlier. The malicious version was published via a hijacked GitHub Actions OIDC publishing pipeline, demonstrating active propagation through CI/CD infrastructure. The worm has pivoted to multi-cloud targeting, now seeking AWS, GCP, and Azure credentials. The attack represents a significant supply chain compromise affecting hundreds of thousands of weekly downloads across multiple npm packages.