Shai-Hulud malware hits 600 npm packages in record wave

Shai-Hulud's latest supply chain campaign has compromised roughly 600 npm packages, nearly doubling the 314-package count from its previous wave and marking the largest single operation this threat actor has executed. The attack vector remains consistent: poisoned packages targeting developer credentials and CI/CD secrets embedded in affected repositories. What has changed is scale and cadence. Weekly waves are now the operational pattern, suggesting an automated or semi-automated pipeline on the attacker side rather than opportunistic one-off intrusions. Essentially: (Shai-Hulud threat group, npm ecosystem) are locked in an escalating cycle where the registry's reactive defenses lag the attack tempo. - Approximately 600 packages confirmed compromised, up from 314 in the prior wave reported by BleepingComputer - Primary payload targets are developer credentials and CI/CD pipeline secrets, not end-user data - Weekly wave cadence indicates infrastructure investment by the attacker, raising the likelihood of further escalation For engineering teams, the threat isn't just the packages themselves but the downstream blast radius if a harvested CI/CD secret reaches production infrastructure before detection.