# package manager security

Published articles for package manager security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The return of Shai-Hulud: How SonarQube detects and contains the npm worm

DevFeed: [The return of Shai-Hulud: How SonarQube detects and contains the npm worm](<https://devfeed.tech/articles/the-return-of-shai-hulud-how-sonarqube-detects-and-contains-the-npm-worm-50236.md>)

Original publisher: [Read original article](<https://www.sonarsource.com/blog/the-return-of-shai-hulud/>)

Author: Taylor Luttrell-Williams

Published: 2026-08-05T13:00:00Z

Content type: article

Language: en

Sources: [Sonar Blog](<https://devfeed.tech/sources/sonar-blog.md>)

Topics: [malicious packages](<https://devfeed.tech/topics/malicious-packages.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Security](<https://devfeed.tech/topics/security.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [Continuous integration](<https://devfeed.tech/topics/continuous-integration.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>)

Tags: [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd-security](<https://devfeed.tech/tags/ci-cd-security.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [coding-agents](<https://devfeed.tech/tags/coding-agents.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [dependency-scanning](<https://devfeed.tech/tags/dependency-scanning.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [node-js-security](<https://devfeed.tech/tags/node-js-security.md>), [npm-ecosystem](<https://devfeed.tech/tags/npm-ecosystem.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [package-manager-security](<https://devfeed.tech/tags/package-manager-security.md>), [packages](<https://devfeed.tech/tags/packages.md>), [quality-gate](<https://devfeed.tech/tags/quality-gate.md>), [secrets-detection](<https://devfeed.tech/tags/secrets-detection.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [software-composition-analysis](<https://devfeed.tech/tags/software-composition-analysis.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [sonarqube](<https://devfeed.tech/tags/sonarqube.md>), [sonarqube-advanced-security](<https://devfeed.tech/tags/sonarqube-advanced-security.md>), [static-analysis](<https://devfeed.tech/tags/static-analysis.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-attack](<https://devfeed.tech/tags/supply-chain-attack.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

This article explains how the self-propagating Shai-Hulud npm worm steals developer and CI credentials, spreads through compromised packages, and executes during installation. It describes SonarQube Advanced Security measures for detecting and containing the threat, including malicious-package detection, quality gates, rescanning, pre-commit checks, MCP pre-flight checks, and secrets detection.

### Source excerpt

Learn how the Shai-Hulud npm worm spreads and see how SonarQube detects malicious packages before they reach production and steal credentials.