[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEmk1VVZUGtStW2lYvQnPX-DRZG3dhM3BKlM2AKId-lE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":45},"40a0fae3-4a0c-4eb9-8a7f-22527d08dca0","self-propagating-worms-target-open-source-package-repositories","79a4a19d-b011-49b7-a57b-519b61936d3b","Self-Propagating Worms Target Open Source Package Repositories","The Shai-Hulud attack variants demonstrate how malicious code can infiltrate trusted open-source repositories and self-propagate by stealing credentials and API keys. These worms specifically target NPM and PyPI ecosystems, affecting over 100 packages including critical infrastructure used by major organizations like Red Hat. The attack's ability to spread autonomously through compromised developer credentials makes it particularly dangerous, as each infected package becomes a vector for further compromise. Organizations relying on open-source packages without proper vetting and monitoring face significant risk of credential theft and unauthorized access to their development environments.","**Immediate actions:**\n- Audit all NPM and PyPI packages in current projects for known malicious variants\n- Implement package integrity verification using cryptographic signatures before installation\n- Rotate all API keys and credentials that may have been exposed through compromised packages\n\n**Long-term improvements:**\n- Establish a software composition analysis (SCA) program to continuously monitor third-party dependencies\n- Create an approved package whitelist and require security review for new dependencies\n- Implement automated scanning of package repositories before integration into development workflows\n\n**Detection measures:**\n- Deploy monitoring for unusual network connections from development environments\n- Set up alerts for unauthorized API key usage or credential access attempts\n- Monitor package manager logs for suspicious installation or update activities",[12,13,14,15,16],"CIS Control 2","NIST SP 800-161","NIST SSDF","SLSA Framework","ISO 27001 A.14.2.1",{},"published","2026-06-09T12:20:25.791425+00:00","2026-06-09T12:20:25.461+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.securityweek.com\u002Fover-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks\u002F","over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks-58c2a0","Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[39],{"id":40,"date":41,"edition":42,"title":43,"audio_url":44},"3c2988b4-608a-4697-b93b-2d4611ccb5cd","2026-06-09","afternoon","ThreatNoir Afternoon Brief — June 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-09\u002Fthreatnoir-afternoon-brief-2026-06-09.mp3",[46,50,54],{"slug":47,"name":48,"problem":49},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":51,"name":52,"problem":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]