The npm worm's real payload was 27,000 public repositories full of other people's secrets
2026-08-15Security
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.