Post
Socket
socket.dev
did:plc:n6f3j47vjucu5ijwdmow7n2w
🚨 A new wave of the Shai-Hulud supply chain attack has hit npm, impacting packages across widely used projects from AsyncAPI, ENS, Postman, PostHog, and Zapier. Attackers added a malicious preinstall script following account compromise. The investigation is ongoing:
https://socket.dev/blog/shai-hulud-strikes-again-v2
2025-11-24T13:38:12.135Z