The Shai-Hulud npm worm showed that opening a folder is enough to run code

The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer who controls widely used npm caching libraries and pushed malicious commits straight into the project's own release pipeline. The resulting package versions carried valid provenance signatures, because... Weiterlesen