---
id: 6739
title: "Shai-Hulud was the best thing to happen to supply chain security"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/shai-hulud-trusted-publishing"
published_at: "2026-08-24T00:00:00Z"
tags: ["supply-chain", "npm", "aikido", "shai-hulud", "software-supply-chain", "trusted-publishing", "oidc"]
phying_url: "https://phying.com/item/6739"
lang: en
---

# Shai-Hulud was the best thing to happen to supply chain security

## Summary

Aikido's data shows npm Trusted Publishing adoption jumped from roughly 20-50 packages a week to 430 after the 2025 attack wave (S1ngularity, the Debug/Chalk phishing, and the self-replicating Shai-Hulud worm that compromised 700+ packages), though only 25% of top-package download volume is covered yet.

## Why it matters

This coverage gives security teams current context for monitoring, validation, and remediation.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-08-24T00:00:00Z
- **Original:** https://www.aikido.dev/blog/shai-hulud-trusted-publishing
- **Phying News:** https://phying.com/item/6739