Shai-Hulud NPM Supply Chain Attack Campaign

Threat actors have launched a coordinated supply chain attack campaign called Shai-Hulud targeting NPM packages, compromising over 600 malicious packages across multiple ecosystems including TanStack and AntV, and leveraging compromised maintainer accounts to distribute malware to developers. The campaign also enabled secondary attacks, including a breach of GitHub's internal repositories through a compromised Nx Console VS Code extension.

This is a long-running storyline that has developed over 25 days. The homepage highlights its most recent activity, so the outlet count there reflects the latest wave. The totals above cover the full run.