Shai-Hulud: How to Tell If Your Builds Pulled an Infected npm Package
The Shai-Hulud worm has hit npm in waves since September 2025, and most infections ran in CI. Here is what each wave did, why lockfiles don't settle whether you were affected, and how to find out.