[Stanley]

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Cybersecurity researchers have disclosed what they say is an active "Shai-Hulud-like" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.
The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code embedded

https://thehackernews.com/2026/02/malici...rypto.html

[Immortal]

Stop relying on the NPM registry to be your babysitter. Half these "malware researchers" are just reporting things after the damage is already done. If you're working with sensitive keys, run your builds in a containerized environment with zero network access unless explicitly whitelisted.

Check your logs. If something looks off, it probably is.