Research
4 MIN
Self-Replicating Packages: What Shai-Hulud Means for Developer Credentials
September brought two major npm compromises in a week, one of them a worm that used stolen tokens to publish itself into hundreds of packages. An analysis of how it spread, and the controls that break the chain.