"Shai-Hulud: Here We Go Again" Are you at risk?

Shai-Hulud is back on npm, and this time it hit keyv and a few hundred other packages with roughly two billion monthly installs behind them. If you write code, you may already have run it.This is the "for dummies" version. One of us builds software for a living, the other asks the questions everybody's actually thinking, so we start at "what even is a package" and work up to why a worm named after a Dune sandworm keeps coming back.A dependency is just somebody else's code running inside your project. Install scripts mean it runs the second you type install, before you've looked at anything. It grabs credentials, uses the publish access it finds, and pushes infected versions of every other package that maintainer owns. That's the loop. That's why it spreads overnight.We also get into the part nobody likes: it isn't ransomware. No note, no payment demand. It takes the keys, opens a back door, and waits. Reports of a dead man's switch that wipes servers if you go looking for it. And no, wiping your laptop doesn't help if your server keys already walked out the door.Not a Windows thing. Not a Mac thing. An open source thing.Chapters00:00 Here we go again00:35 What's a package, and why do you have thousands of them01:30 Install scripts and how it steals your keys02:20 How it copies itself into everything you publish02:55 Package signing, and why this is hard to stop04:05 npm, open source, and the dependency you didn't know you had04:40 Who's actually at risk (sorry, mom in Montana, not you)05:30 The dead man's switch06:00 Not ransomware. A back door playing the long game06:40 White hat, black hat, and the guy who breaks windows to sell windows07:40 Why "Shai-Hulud"? The Dune name and what it means08:15 What a stolen developer credential actually opens09:00 Windows problem or Apple problem? Neither09:25 Wrap upCheck your lockfiles. Rotate your tokens. Then come tell us in the comments if you got hit.If this one made sense to you, send it to the developer in your life who hasn't heard yet. Like and subscribe so we can get across a thousand.#ShaiHulud #npm #SupplyChainAttack #CyberSecurity #OpenSource #DevSecOps #Malware #Dune #WebDev #InfoSec