Shai-Hulud: Whoever controls your package registry controls your pipeline

August 31, 2026 · 4:00 pm 1 sources

Image: The New Stack

Coverage

More coverage

• Shai-Hulud: Whoever controls your package registry controls your pipeline
  The New Stack · August 31, 2026 16:00
  On September 15, 2025, npm’s registry did something unprecedented: Packages began updating themselves. No maintainer ran npm publish. No pull The post Shai-Hulud: Whoever controls your package registry controls your pipeline appeared first on The New Stack .