The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one

A hijacked GitHub account let the Shai-Hulud worm pass npm's trust check, spreading through packages with 2 billion monthly ...