GitLab discovers widespread npm supply chain attack

GitLab discovered a widespread npm supply chain attack involving an evolved version of the Shai-Hulud malware. The malware harvests credentials from GitHub, npm, AWS, GCP, and Azure, then propagates by automatically infecting other packages owned by victims. Most critically, it contains a 'dead man's switch' mechanism that destroys user data if its propagation channels are severed. The attack uses stolen tokens to create GitHub repositories as data exfiltration points and spreads through npm packages via malicious preinstall scripts. The worm-like propagation creates a resilient botnet-like network where compromised systems share access tokens.