GitHub & npm Under Siege: Megalodon, Shai-Hulud, and Wormable Malware Redefine Supply Chain Risk
Trusted build systems are becoming the attack surface, letting malware spread faster than review can stop it.
What is this trend?
Wormable supply-chain attacks now exploit CI/CD trust, identity tokens, and package pipelines to steal secrets and push malicious updates at ecosystem scale.
- Trusted automation can be turned into a propagation channel, not just a target.
- Token theft and workflow abuse let attackers publish malware that looks legitimate.
- A single poisoned dependency can cascade into thousands of repos and downstream builds.
- Traditional scanning lags behind attacks that move at machine speed and self-replicate.
- Defenses are shifting toward tighter pipeline controls, secret rotation, and provenance checks.
What’s the latest?
AI-powered npm worms like ChainDrop are hijacking trusted developer pipelines and poisoning billions of downloads, exposing Mac devs and their credentials at unprecedented scale and speed.
How it developed earlier updates
A coordinated wave of supply chain attacks—led by Megalodon and Shai-Hulud—has shattered trust in open-source automation, hijacking thousands of GitHub repos and npm packages with stealthy, wormable m
GitHub & npm Under Siege: Megalodon, Shai-Hulud, and Wormable Malware Redefine Supply Chain RiskMassive audits reveal that even top repositories are riddled with misconfigurations, turning trusted automation into prime targets for supply chain attacks.
‘Cordyceps’ Exploit Exposes Crumbling Trust in GitHub Actions, Sparking CI/CD Security ReckoningAI-powered npm supply chain attacks like SANDWORM_MODE are exploiting coding assistants and CI/CD pipelines to steal developer secrets and deploy undetectable, multi-stage malware—exposing critical bl
AI-Powered npm Attacks Expose Deep Flaws in Supply Chain SecurityThe breach’s real danger stemmed from automation tokens and workflow secrets that remained valid for months, enabling attackers to persistently infiltrate major tech ecosystems.
LiteLLM-Trivy Hack Fallout: Stolen Keys Still Haunt 2,500 Firms