The packages were injected with malicious code to harvest secrets, dump them to a public repository, and make private repositories public.

The post Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit appeared first on SecurityWeek.