Shai-Hulud: Self-Replicating Worm Compromises 500+ NPM Packages

The Shai-Hulud worm has compromised over 500 NPM packages in the first successful self-replicating worm attack on the NPM ecosystem. The malware targets popular packages including @ctrl/tinycolor and automatically spreads to other maintainer packages. It harvests cloud credentials from AWS, GCP, and Azure using TruffleHog tools. The worm establishes persistence through GitHub Actions backdoors. This represents an unprecedented self-propagating supply chain attack affecting the JavaScript/Node.js ecosystem. The attack demonstrates advanced techniques combining credential harvesting with automated package propagation.