Yesterday, the npm was hit by the third-largest supply chain compromise in its history, a new Shai-Hulud (named for Dune sandworms). Diving into the code we find thatβas in Heretics of Duneβthe danger is not so much the worm itself as the ecology that has evolved around it: