CISA issues an alert regarding a widespread supply chain compromise affecting the npm package ecosystem. A self-replicating worm, named "Shai-Hulud," has infected over 500 packages within the npmjs.com registry. The malware scans for sensitive credentials, focusing on GitHub Personal Access Tokens and cloud service API keys. It then exfiltrates harvested credentials and uploads them to a public repository. This worm spreads rapidly by injecting malicious code into other packages and publishing compromised versions. CISA strongly advises organizations to conduct comprehensive dependency reviews of their software. Organizations should check for affected packages using package-lock.json or yarn.lock files. They should pin npm package versions to safe releases from before September 16, 2025, and rotate all developer credentials immediately. Implementing phishing-resistant MFA on developer accounts, monitoring unusual network activity, and blocking connections to suspicious domains are crucial. Hardening GitHub security through recommended measures like removing unnecessary apps and enabling protection rules is also advised. Resources from GitHub, Palo Alto Networks, Socket, and ReversingLabs provide further details on the compromise. This alert aims to guide organizations in detecting and remediating this significant security threat.