Based on this YouTube video's total view count of 9.26K views and industry-standard rates, the estimated total earning is $6 - $19 through ad revenue. Historical data is not yet available to calculate daily, weekly, or monthly averages.

Explore Your npm install Is Lying To You About What's Already Inside with 9,265 views, 572 likes, and 75 comments. Experience the impact of this video content that has captured audience attention.

A self-replicating npm worm named Shai-Hulud has hit the JavaScript supply chain four times in five months, and the newest version deletes everything you own the moment you try to lock it out. This is the cyber security story every developer is missing: the anatomy of the worm eating the npm software supply chain, the GitHub Actions hack that forged valid provenance, and the four-line .npmrc fix that actually stops it. The Shai-Hulud worm harvests OIDC tokens directly out of GitHub Actions process memory, forges valid npm provenance attestations on its way out, replicates across maintainer accounts, and the May 2026 variant detonates an `rm -rf ~/` payload as a dead-man's switch. Mini Shai-Hulud broke the very provenance feature npm shipped to stop it. In this video you'll see: - What a supply chain attack actually is, in 90 seconds - The npm worm's lineage: four self-replicating attacks across five months, each larger than the last - The five-stage anatomy of Mini Shai-Hulud (the fork, the forged trust, the harvest, the spread, the dead-man's switch) - The Sandworm name connection: why an npm worm shares a codename with both a Dune monster and Russia's GRU hacking unit (spoiler: different actors, same mythology, and the metaphor isn't an accident) - The developers who warned this was coming a decade ago, including Mitchell Hashimoto on dependency count and the chalk/debug maintainers on burnout-as-attack-surface - The actual fixes that work: `ignore-scripts=true`, a few-day cooldown on new packages, `npm ci` over `npm install`, trusted publishing (with the honest caveat that provenance proves origin, not integrity), and the Hashimoto move on vendoring If you run an `npm install` against a project you care about, this is the video to watch before your next deploy. 🔮 My Consulting: Post-quantum security & cryptography advisory → Learn more https://www.lamarrlabs.com/ 🧠 My Newsletter: → LaMarr Labs: Biweekly notes on the post-quantum transition (PQC, timelines, what to do next). https://lamarrlabs.substack.com/ → Addie LaMarr: Cybersecurity + tech writing (threats, tools, and the future of the internet). https://addielamarr.substack.com/ 📘 My Course: Zero to Cyber Hero: a step-by-step roadmap into cybersecurity → Start here https://addie-clark.mykajabi.com/zero-to-cyber-hero-waitlist-discount 🖇️ Let's Connect: https://www.linkedin.com/in/addie-clark/ 📚 Sources: → Orca Security — Mini Shai-Hulud / TanStack worm: https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/ → Palo Alto Unit 42 — Shai-Hulud npm worm: https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ → Palo Alto Unit 42 — npm threat landscape: https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ → Datadog Security Labs — Shai-Hulud 2.0 analysis: https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ → Microsoft Security — Shai-Hulud 2.0 guidance: https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/ → Sysdig — Shai-Hulud self-replicating worm: https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages → CISA alert — Widespread npm supply chain compromise: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem → Semgrep — chalk, debug, color compromised (Sept 2025): https://semgrep.dev/blog/2025/chalk-debug-and-color-on-npm-compromised-in-new-supply-chain-attack/ → Aikido — npm debug and chalk packages compromised: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised → Wikipedia — Sandworm (hacker group): https://en.wikipedia.org/wiki/Sandworm_(hacker_group)) → Wikipedia — Sandworm (Dune): https://en.wikipedia.org/wiki/Sandworm_(Dune)) → Andy Greenberg — The Untold Story of NotPetya (Wired): https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ → GitHub Changelog — npm trusted publishing + script security GA: https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/ → npm Docs — Trusted publishing for npm packages: https://docs.npmjs.com/trusted-publishers/ → pnpm — Mitigating supply chain attacks: https://pnpm.io/supply-chain-security → Mitchell Hashimoto — Libghostty Is Coming (zero-dependency design): https://mitchellh.com/writing/libghostty-is-coming 📖 Books Mentioned: → Sandworm (Andy Greenberg, 2019) https://www.wwnorton.com/books/9780525564621/about-the-book/product-details → Dune (Frank Herbert, 1965) → This Is How They Tell Me the World Ends (Nicole Perlroth, 2021) — https://www.bloomsbury.com/us/this-is-how-they-tell-me-the-world-ends-9781635576078/

With SocialCounts.org’s view counter, track your YouTube video’s live view count and YouTube likes count in real time with fast, reliable updates.

Watch every YouTube video live view count rise with our real-time YouTube views tracker—built for accuracy and minimal delay.

Follow YouTube real time views as they happen, using our dedicated view counter for YouTube videos.

Get up-to-date live view count on YouTube and see real-time growth with SocialCounts.org’s smart tracking tools.