.png)
Shai-Hulud Worm Pivots to Multi-Cloud: [email protected] Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Scope
Twenty-nine hours after [email protected] and @cap-js/[email protected] were compromised by the Shai-Hulud worm, a third major npm package has fallen: [email protected], the official Node.js SDK for the Intercom customer messaging platform, with 361,510 weekly downloads — more than the two yesterday’s compromised packages combined. The malicious version was published today at 14:41 UTC via a hijacked GitHub Actions OIDC publishing pipeline, confirming the worm is actively propagating through CI/CD infrastructure stolen from yesterday’s victims.
.png)
