Post

shai-hulud doesn't knock. someone hid bad ingredients in a kitchen. eight hours of nothing. the meal went out with a valid health certificate. this is what the biggest npm attack of the year looked like.

no passwords stolen. no locks picked. five actors. one kitchen. watch where the arrows go.

1/ the attacker did nothing for 8 hours. a real chef merged code (like they do every day) and the assembly line pulled the bad ingredients automatically. the health certificate was applied and the meal shipped. every verification layer said yes.

3/ remediation was the attack. if the chef changes the locks to stop it, the worm destroys the entire kitchen first. rotating your credentials was already in the plan. npm uninstall didn't touch it. it was already living in the walls.

5a/ so why didn't they move faster? they had credentials. they had access. they had a live worm inside a major ecosystem. but they waited. they ran the spread methodically. they armed a dead man switch before touching anything irreversible. someone wrote a spec. the worm had a project manager.

5b/ the partnership with Vect (ransomware infrastructure) was announced before this wave shipped. the next wave won't be credential theft. it won't be a worm either.