How we got hit by Shai-Hulud: A complete post-mortem | Trigger.dev
On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.
Shai Hulud Strikes Again (v2) - Socket
socket.devAnother wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
No more tokens! Locking down npm Publish Workflows—zachleat.com
A post by Zach Leatherman (zachleat)