1004: TanHacked

The "Shai-Hulud" supply chain attack series has compromised numerous popular JavaScript and Python packages by exploiting GitHub Actions' shared cache. Attackers poisoned the pnpm store directory, allowing them to execute malicious scripts during legitimate builds and harvest sensitive OIDC tokens. This sophisticated worm, which evolved through multiple iterations, even included a dead man switch that could delete local home directories if tokens were revoked. Developers can mitigate these risks by avoiding the `pull_request_target` hook, enabling minimum release age settings in package managers like pnpm, and utilizing security-focused tools such as Socket.dev or Snyk. Additionally, adopting dev containers provides a necessary layer of isolation, preventing malicious scripts from accessing host system files. These incidents highlight the urgent need for more robust security defaults within the npm ecosystem to protect developers from automated, self-propagating threats.