# worm

Published articles for worm.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough

DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough](<https://devfeed.tech/articles/chaindrop-npm-worm-why-slsa-provenance-wasn-t-enough-13377.md>)

Original publisher: [Read original article](<https://www.harness.io/blog/chaindrop-npm-worm-valid-provenance>)

Author: Harness Team

Published: 2026-08-10T00:00:00Z

Content type: article

Language: en

Sources: [Harness Blog](<https://devfeed.tech/sources/harness-blog.md>)

Topics: [ChainDrop](<https://devfeed.tech/topics/chaindrop.md>), [npm](<https://devfeed.tech/topics/npm.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [security](<https://devfeed.tech/tags/security.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence.

### Source excerpt

ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog

## The npm worm that installs itself into your coding agent

DevFeed: [The npm worm that installs itself into your coding agent](<https://devfeed.tech/articles/the-npm-worm-that-installs-itself-into-your-coding-agent-16036.md>)

Original publisher: [Read original article](<https://workos.com/blog/npm-worm-coding-agent-config-credentials>)

Author: WorkOS

Published: 2026-08-06T15:20:55Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Claude Code](<https://devfeed.tech/topics/claude-code.md>), [Visual Studio Code](<https://devfeed.tech/topics/visual-studio-code.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [code](<https://devfeed.tech/tags/code.md>), [github](<https://devfeed.tech/tags/github.md>), [hooks](<https://devfeed.tech/tags/hooks.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [repo](<https://devfeed.tech/tags/repo.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [vscode](<https://devfeed.tech/tags/vscode.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

The article analyzes a Shai-Hulud npm worm that plants executable hooks in .claude/settings.json and .vscode/tasks.json. Opening a compromised repository can trigger the payload in VS Code or Claude Code, creating an attack path that install-time defenses may not detect.

### Source excerpt

A Shai-Hulud wave plants hooks in .claude/settings.json and .vscode/tasks.json, so opening a repo runs the payload. Agent config is executable surface now.

## Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do

DevFeed: [Luck isn't a security control: What happened with mini Shai-Hulud and what you need to do](<https://devfeed.tech/articles/luck-isn-t-a-security-control-what-happened-with-mini-shai-hulud-and-what-you-need-to-do-13141.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/luck-isnt-a-security-control-what-happened-with-mini-shai-hulud-and-what-you-need-to-do>)

Published: 2026-05-13T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm](<https://devfeed.tech/topics/npm.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [ai-coding-agents](<https://devfeed.tech/tags/ai-coding-agents.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [mini-shai-hulud](<https://devfeed.tech/tags/mini-shai-hulud.md>), [npm](<https://devfeed.tech/tags/npm.md>), [packages](<https://devfeed.tech/tags/packages.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

This article examines the mini Shai-Hulud supply chain worm, which affected more than 400 packages. It argues that malicious code can enter during package build and distribution without a CVE, and that teams should strengthen preventive security across registries, GitHub Actions, CI/CD pipelines, dependencies, AI coding agents, and configuration files.

### Source excerpt

A new supply chain worm hit 400+ packages. Learn why preventive security, not reactive patching, is the only way to stop the next attack.

## Cyber resiliency in practice: Lessons from recent supply chain attacks

DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks](<https://devfeed.tech/articles/cyber-resiliency-in-practice-lessons-from-recent-supply-chain-attacks-13017.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/cyber-resiliency-in-practice-lessons-from-recent-supply-chain-attacks>)

Published: 2026-05-08T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [resiliency](<https://devfeed.tech/topics/resiliency.md>), [supply chain attacks](<https://devfeed.tech/topics/supply-chain-attacks.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [axios](<https://devfeed.tech/topics/axios.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [litellm](<https://devfeed.tech/topics/litellm.md>), [trivy](<https://devfeed.tech/topics/trivy.md>), [npm](<https://devfeed.tech/topics/npm.md>), [PyPI](<https://devfeed.tech/topics/pypi.md>), [Python](<https://devfeed.tech/topics/python.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>)

Tags: [axios](<https://devfeed.tech/tags/axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [cyber-resiliency](<https://devfeed.tech/tags/cyber-resiliency.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [litellm](<https://devfeed.tech/tags/litellm.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [pypi](<https://devfeed.tech/tags/pypi.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [security-attacks](<https://devfeed.tech/tags/security-attacks.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [trivy](<https://devfeed.tech/tags/trivy.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases.

### Source excerpt

Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM.

## Chainguard customers safe from new npm worm and xinference supply chain attack

DevFeed: [Chainguard customers safe from new npm worm and xinference supply chain attack](<https://devfeed.tech/articles/chainguard-customers-safe-from-new-npm-worm-and-xinference-supply-chain-attack-12939.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-customers-safe-from-new-npm-worm-and-xinference-supply-chain-attack>)

Published: 2026-04-22T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [Library](<https://devfeed.tech/topics/library.md>), [chainguard libraries](<https://devfeed.tech/topics/chainguard-libraries.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-malware](<https://devfeed.tech/tags/chainguard-malware.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [github](<https://devfeed.tech/tags/github.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-malware](<https://devfeed.tech/tags/npm-malware.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [packages](<https://devfeed.tech/tags/packages.md>), [pypi-malware](<https://devfeed.tech/tags/pypi-malware.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [worm](<https://devfeed.tech/tags/worm.md>), [xinference](<https://devfeed.tech/tags/xinference.md>)

### AI overview

The article reports npm and PyPI malware attacks affecting 25 packages with more than 60,000 combined monthly downloads. It explains that Chainguard customers were protected because Chainguard builds from verifiable source code and rejects packages that rely on install-time scripts.

### Source excerpt

New npm and PyPI malware hit many popular packages. Chainguard customers stayed protected by blocking install scripts and rebuilding only verified source code.

## SHA1-Hulud, npm supply chain incident

DevFeed: [SHA1-Hulud, npm supply chain incident](<https://devfeed.tech/articles/sha1-hulud-npm-supply-chain-incident-8097.md>)

Original publisher: [Read original article](<https://snyk.io/blog/sha1-hulud-npm-supply-chain-incident/>)

Author: Brian Vermeer

Published: 2025-11-24T18:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [npm](<https://devfeed.tech/topics/npm.md>), [snyk](<https://devfeed.tech/topics/snyk.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Azure](<https://devfeed.tech/topics/azure.md>), [Google Cloud Platform (GCP)](<https://devfeed.tech/topics/google-cloud.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloud-infrastructure](<https://devfeed.tech/tags/cloud-infrastructure.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [npm](<https://devfeed.tech/tags/npm.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [sha1-hulud](<https://devfeed.tech/tags/sha1-hulud.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [trust](<https://devfeed.tech/tags/trust.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

Snyk reports SHA1-Hulud, a second-wave npm supply chain attack and worm that spreads through trojanized packages with hidden preinstall scripts. The worm can compromise GitHub Actions self-hosted runners, inject malicious workflows, execute remote commands, exfiltrate GitHub and npm secrets, and search for AWS, Azure, and GCP credentials. Snyk identified more than 600 impacted npm packages and is retesting customer assets, notifying affected customers, and updating its vulnerability databases.

### Source excerpt

Snyk identified a new supply chain attack in the npm ecosystem, referred to as SHA1-Hulud. We believe this is a second wave of the Shai-Hulud attack. Learn what this attack is and how Snyk is responding.

## Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack

DevFeed: [Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack](<https://devfeed.tech/articles/zero-day-extensive-npm-package-compromise-shai-hulud-supply-chain-attack-7902.md>)

Original publisher: [Read original article](<https://snyk.io/blog/embedded-malicious-code-in-tinycolor-and-ngx-bootstrap-releases-on-npm/>)

Author: Brian Clark

Published: 2025-09-15T11:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [Bootstrap](<https://devfeed.tech/topics/bootstrap.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Security](<https://devfeed.tech/topics/security.md>), [data](<https://devfeed.tech/topics/data.md>), [Front end](<https://devfeed.tech/topics/frontend.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [angular](<https://devfeed.tech/tags/angular.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [package-compromise](<https://devfeed.tech/tags/package-compromise.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

This article reports the Shai-Hulud supply chain attack, in which malicious versions of ngx-bootstrap and other npm packages embedded malware to harvest developer tokens, cloud credentials, API keys, and other secrets. The malware exfiltrated data through webhooks and public GitHub repositories, targeted CI/CD environments through GitHub Actions, and spread across hundreds of compromised packages. The article recommends treating affected systems as compromised, removing the packages, rotating secrets from a trusted machine, and investigating for lateral movement.

### Source excerpt

A supply chain attack hit the ngx-bootstrap npm package, embedding malware to steal developer credentials. See affected versions (e.g., 20.0.4-6, 19.0.3) and our playbook to contain the threat and rotate compromised secrets.

## Highs and Lows of IEEE Computer Magazine

DevFeed: [Highs and Lows of IEEE Computer Magazine](<https://devfeed.tech/articles/highs-and-lows-of-ieee-computer-magazine-38880.md>)

Original publisher: [Read original article](<http://neopythonic.blogspot.com/2009/06/higs-and-lows-of-ieee-computer-magazine.html>)

Author: Guido van Rossum (noreply@blogger.com)

Published: 2009-06-17T01:47:00Z

Content type: opinion

Language: en

Sources: [Guido van Rossum](<https://devfeed.tech/sources/guido-van-rossum.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Python](<https://devfeed.tech/topics/python.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [python](<https://devfeed.tech/tags/python.md>), [security](<https://devfeed.tech/tags/security.md>), [software-engineering](<https://devfeed.tech/tags/software-engineering.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

The author reviews an issue of IEEE Computer, praising its detailed history of the Conficker worm and its discussion of the worm's creators and geographic distribution. The author criticizes an article on software engineering ethics for presenting a redundant and unhelpful table, and notes that the Conficker discussion omitted potentially useful data on installed PCs by country.

### Source excerpt

I still read a few print publications, including IEEE Computer. Today's issue contained a high and a low: Today's high point was a detailed history of the Conficker worm. Since we're a Macintosh family, and Google typically has its security stuff in order, I was barely aware of it. The sophistication of the worm's creators is almost admirable. (They probably use Python too. :-) An interesting table in the article included information about which countries contribute the most to the worm's population. China, Brazil and Russia top the list. You could have all sorts of theories on why this would be; personally I'm assuming it's a combination of sheer number of computers plus widespread use of bootlegged copies of Windows. The low point was an article on "Software Engineering Ethics." Why a low point? Look at this table and think of how many bits of information it contains: Using postphenomenology for software engineering ethics ActionsDesirableUndesirable Amplify experiences that are+- Reduce experiences that are-+ Invite actions that are+- Inhibit actions that are-+ Ironically, this pointless table contains a redundant column, while the table I mentioned above was missing a column that would have been useful -- how many PCs are installed in each country. Oh well. PS: Googling for "postphenomenology" gives this as the title of the first hit: "If phenomenology is an albatross, is postphenomenology possible?" The web knows best.