Shai-Hulud: Whoever controls your package registry controls your pipeline

TL;DR

A malicious worm named Shai-Hulud exploited npm's registry to autonomously update packages, stealing credentials and spreading further. Its evolution led to targeted attacks on AI tool credentials, highlighting vulnerabilities in package management systems.

Key Takeaways

• Pin all package dependencies to immutable references.
• Use short-lived, scoped credentials for deployments.
• Restrict outbound access for CI runners to necessary domains.
• Route package resolution through a private, versioned registry.