@briankrebs@infosec.exchange Worth flagging for anyone patching downstream of this: Shai-Hulud did not exploit a vulnerability, it stole maintainer credentials from GitHub and npm through phishing. Any organisation depending on npm packages needs mandatory two-factor authentication and signed provenance for its critical dependencies, not just a CVE watch. The CRA's open-source steward obligations arrive none too soon.