How we got hit by Shai-Hulud: A complete post-mortem | Trigger.dev

On November 25th, one of our engineers was compromised by the Shai-Hulud npm supply chain worm. Here's what happened, how we responded, and what we've changed.