Cybersecurity researchers have disclosed what they say is an active „Shai-Hulud-like“ supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.
The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code embedded
https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html