TLDR overview
- Shai-Hulud is a self-propagating npm supply chain worm that steals developer and CI credentials to republish itself across more packages.
- It executes at install time, so any Node.js project or CI pipeline that installs a compromised version is exposed, with no manifest edit required.
- SonarQube Advanced Security detects and contains it in layers: malicious package detection (SCA) raises blocker-severity risks that can fail quality gates, and a daily rescan re-flags packages that turn malicious after you install them.
- Supporting layers add a SonarQube CLI pre-commit hook, an MCP
check_dependency
pre-flight for coding agents, and secrets detection.