Riding the Worm: Lessons from the NPM Supply Chain Attack

Mark and Rohan break down the recent Shai-Hulud NPM supply chain attack, one of the most extensive JavaScript ecosystem compromises to date. They trace how a phishing campaign against NPM maintainers led to malicious package updates, the challenges in surfacing risks buried deep in dependency chains, and the implications for development teams shipping AI-generated code at scale. The discussion also explores how ArmorCode’s agentic AI, Anya, helps security teams detect anomalous package behavior by querying across code, pipelines, and deployments—before infected packages make it to production.