The return of Shai-Hulud: How SonarQube detects and contains the npm worm
TLDR overview
- Shai-Hulud is a self-propagating npm supply chain worm that steals developer and CI credentials to republish itself across more packages.
- It executes at install time, so any Node.js project or CI pipeline that installs a compromised version is exposed, with no manifest edit required.
- SonarQube Advanced Security detects and contains it in layers: malicious package detection (SCA) raises blocker-severity risks that can fail quality gates, and a daily rescan re-flags packages that turn malicious after you install them.
- Supporting layers add a SonarQube CLI pre-commit hook, an MCP
check_dependency
pre-flight for coding agents, and secrets detection.
How it works
Once you click Generate, Ollama reads this article and crafts 5 comprehension questions. Your answers are graded against the article content — general knowledge won't be enough. Score 70+ to count toward your certificate.
Questions are cached — you'll always get the same 5 for this article.