Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets

Post-mortem of Shai-Hulud attack on November 24th, 2025

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

Shai-Hulud worm returns, belches secrets to 25K GitHub repos