npm registry attacked by secret-stealing worm

Detecting and responding to npm package compromise by the Shai-Hulud worm

A new large-scale attack on a popular JavaScript code registry has hit around 150 packages. The automatic propagation of the threat makes it especially dangerous — developers need to react ASAP.