The npm Worm Doesn't Care How Good Your CI Is

On 6 August, Singapore's Cyber Security Agency published an advisory about an active npm supply chain attack involving malicious versions of Keyv and related packages, spread by a worm called Shai-Hul