Supply ChainShai-Hulud: the first self-propagating npm worm (2025), explained Most supply-chain incidents are a single bad package. Shai-Hulud was different: it used what it stole to publish itself into more packages, on its own. Aug 3, 2026 · 3 min read