Hulud" has compromised hundreds of packages in the npm repository with a self-replicating worm that steals secrets like API key, tokens, and cloud credentials and sends them to external servers that ...

The vendor was one of a many whose code modules were infected by a never before seen strand of malware known as "Shai-Hulud." ...