The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
An attacker on Tuesday took over the GitHub account of the developer who maintains keyv, a small key-value storage library that npm serves roughly 127 million times a week. Within hours, poisoned versions of keyv and its sibling caching packages were live on npm, carrying a credential-stealing…
No discussion yet. Be the first to share your thoughts!