Resharing this post I wrote several weeks ago, in light of another incarnation of the "Sha1-Hulud" attack on the npm ecosystem which emerged overnight.
If you are unsure if you were affected, your package.lock file will always show the exact version of the npm package installed, even if using fuzzy versions in your package.json file.
Information about this incarnation of the Sha1-Hulud threat is still emerging, but it seems to follow the same pattern as the last attack, where data was exfiltrated via the creation of a public GitHub repository. Validating that this repo does not exist in your organizational GitHub accounts and those of employees is important. It should be noted though that for the previous round, GitHub themselves acted rapidly containing the repositories and notifying affected individuals.
Due to the nature of how the worm worked during the previous outbreak, it was less likely to be able to exfil data from CI/CD pipelines (like for example when building a site on Netlify). Usually in this execution context, general write access to GitHub is not available. For this reason, it seems that the more likely target of this attack is developer workstations, who much more likely will have both environment variables and an active GitHub session.
