The Shai-Hulud worm is a self-replicating malware that has compromised 500+ npm packages. It steals credentials, creates malicious GitHub repositories, and spreads automatically across the npm ecosystem. This guide provides step-by-step detection and removal instructions.
During a routine project update where I cleared npm dependency cache and updated my Dockerfile and GitHub workflow, my Docker build started hanging unexpectedly. Initially suspecting my Dockerfile changes, I reverted them but the issue persisted. This suspicious behavior led me to investigate npm-related issues, where I discovered news about the Shai-Hulud worm infecting 500+ packages. Upon checking, I found several compromised packages in my project dependencies.