Shai-Hulud spreads by bumping a version number your dependency range already accepts

"Earlier in the install process" is the phrase in that account doing the most work, and it is the one you cannot act on. The New Stack says the November variant moved its execution earlier to render developer triggers irrelevant ^[16]. It does not name the hook. If the new entry point is still a lifecycle script, installing with scripts disabled covers it. If it is not, that control covers the September payload and not the thing that replaced it. One sentence of a writeup does not settle which, and the difference is the difference between a fix and a speed bump.

The propagation step needs one thing to work downstream: a version number that something will resolve. It bumps the version and republishes under the maintainer's own name ^[5], so a consumer whose manifest carries a range picks up the poisoned build on its next resolve, while a consumer installing from a recorded exact version does not until someone re-resolves ^[13]. A lockfile inspects nothing. It declines to select a version that was not recorded when it was written, and that is the whole of its contribution here.

The same account describes the limit case. On August 4, 2026, a variant called ChainDrop compromised more than 400 packages in under four hours by riding a legitimate, cryptographically signed release pipeline, so each poisoned version arrived with a valid SLSA provenance attestation ^[10]. That is better than 100 packages an hour ^[15]. Its command channel sat inside an Ethereum smart contract, which renders domain blocklists moot ^[11]. The attestation was accurate, and that is the problem: provenance answers who built the artifact, not what the artifact does.

Treat 500-plus and 796 as counts from someone else's dependency graph. They are not even the same unit, since September counted package versions altered and November counted packages backdoored ^[3][16], so dividing them gives 1.59 and means nothing as a growth rate ^[14]. For either figure to reach your pipeline, one of those names has to sit in your tree, directly or transitively, and your install has to re-resolve a range rather than read a pin.

Two smaller details are worth keeping. The payload downloaded Trufflehog, a legitimate open source secret scanner, to confirm that the credentials it harvested were live ^[2]; the worm ships with a validation step that some internal secret audits skip. Palo Alto Networks' Unit 42 is moderately confident that parts of the script were written by an LLM, going on comments and emoji embedded in the payload ^[8].

The generalization in that piece holds up: swap npm publish for terraform apply and the mechanics hardly change ^[12]. Install-time execution with the permissions of whatever ran the install is a property of registries, not of JavaScript ^[6]. The worm never has to persuade a reviewer, because it only ever needed one credential and an install script ^[7].