Trusted npm Packages Became the Trapdoor in Red Hat's Supply Chain

At least 32 packages in an official Red Hat namespace were reported compromised, showing how a single poisoned dependency can turn routine installs into a secret-harvesting event.

When Malware Turns Its Own Blueprint Loose, Supply Chains Get Harder to Trust

A hacking group’s release of Shai-Hulud worm source code raises the risk of reuse, copycat abuse, and fresh pressure on developer ecosystems.

Il worm Shai-Hulud si diffonde oltre npm e attacca anche Maven

Infamous Shai-hulud Worm Resurfaces From the Depths