Off-topic for aiqbench
This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.
Chainguard customers safe from Mini Shai-Hulud worm targeting @redhat-cloud-services npm packages with 100K+ weekly downloads
A new npm worm hit 90+ Red Hat packages. Chainguard customers stayed protected by blocking install-time scripts and hardening CI/CD workflows.
Chainguard customers using Chainguard Libraries for JavaScript and Chainguard Actions are unaffected by today's Mini Shai-Hulud attack targeting the @redhat-cloud-services npm scope. An attacker compromised a Red Hat employee's GitHub account and used the associated GitHub Actions OIDC trusted publisher to ship malicious versions across 90+ packages in the scope. Together, these projects average more than 100,000 weekly downloads. The worm self-propagates by republishing tampered npm tarballs and injecting malicious GitHub Actions workflows…
Excerpt shown under the publisher's RSS terms · 73 words · full text and figures are on the publisher's site