A terrifying, self-replicating malwaere has infected npm packages with over 2 million downloads per week - here's how to stay safe

Virus symbol, computer protection, cyber attack, antivirus, digital worm and bug icon. Futuristic abstract concept 3d rendering illustration.

• A new supply-chain attack compromised at least 187 npm packages, targeting developer secrets across software projects
• Shai-Hulud worm looks to steal credentials, modify packages, and spread malware through GitHub Actions and npm tokens
• Researchers warn the number of compromised packages is likely to grow

At least 187 malicious npm packages have been uncovered, part of a yet another major supply-chain attack against software developers.