Poisoned Packages: How npm Lifecycle Scripts Became a Supply Chain Weapon
Microsoft Threat Intelligence published a technique profile on malicious npm lifecycle scripts — the mechanism behind Shai-Hulud 2.0, Contagious Interview, and multiple North Korean campaigns. This post breaks down how lifecycle scripts work as an attack vector, the real-world campaigns exploiting them, and a layered defense strategy for dev teams and CI/CD pipelines.