⚠️ Region Alert: UAE/Middle East This article provides a technical deep-dive into the evolution of npm supply chain attacks, centered on the Shai-Hulud worm and recent campaigns by the threat actor TeamPCP. The malware represents a significant shift from simple typosquatting to sophisticated, self-propagating threats that automate the compromise of legitimate software packages. By targeting a malicious @bitwarden/cli package, the attackers utilize multi-stage payloads to harvest credentials from cloud providers, CI/CD environments, and developer workstations. The Shai-Hulud worm is particularly dangerous due to its ability to automatically backdoor any npm package the victim has publishing rights to, creating an exponential propagation vector. The malware employs advanced obfuscation, including a custom Fisher-Yates shuffle cipher for string encryption and a resilient C2 infrastructure that uses GitHub search as a fallback dead-drop.…