References¶

• Wiz: Shai-Hulud Attack — Wiz.io
• StepSecurity — StepSecurity: Mini Shai-Hulud
• TanStack postmortem — tanstack.com/blog/npm-supply-chain-compromise-postmortem / GHSA-g7cv-rxg3-hmpx
• GitHub Security Lab pwn-requests series — securitylab.github.com/resources/github-actions-preventing-pwn-requests
• GitHub Docs — Security hardening for GitHub Actions
• Semgrep — PyTorch Lightning malware (lightning 2.6.2/2.6.3)
• OpenSSF Scorecard — github.com/ossf/scorecard
• The worms will continue until the ecosystem improves — https://basicsarehard.substack.com
• Aikido Security: Mini Shai-Hulud — https://www.aikido.dev/blog/mini-shai-hulud