Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack A potentially monumental supply chain attack is underway, thanks to a self-replicating worm-like payload that has been compromising packages published on the npm Registry. The worm has been dubbed “Shai-hulud” as it steals credentials from victims who run a compromised package and publishes them in a public GitHub repository which contains the name. The worm also uses npm authentication tokens stolen from the victims to perpetuate the cycle of infection and compromise, and compromised GitHub tokens to exfiltrate authentication secrets and makes private repositories public. About npm and npm tokens Npm is a package manager for the JavaScript programming language and an online repository (at npmjs.com)…