Mini Shai-Hulud worm hits 170+ npm packages

Mini Shai-Hulud is a landmark security incident that weaponizes modern CI/CD primitives like OIDC and SLSA provenance to distribute authenticated malware.

• –Malware scrapes `/proc/{pid}/mem` to extract masked secrets from GitHub Actions runners, bypassing standard environment variable protections.
• –By hijacking OIDC tokens during build-time, the worm publishes malicious versions with valid SLSA Build Level 3 attestations.
• –A "dead-man's switch" installs local persistence to monitor token validity; any attempt to revoke compromised credentials triggers an immediate wipe of the root directory.
• –The attack effectively subverts "trusted publishing" workflows, proving that provenance attestations only secure the build's origin, not its content's integrity.