discovered
@postman/tunnel-agent is identified in the SafeDep analysis "Shai-Hulud 2.0 npm Supply Chain Attack Technical Analysis". Critical npm supply chain attack compromises zapier-sdk, @asyncapi, posthog, and @postman packages with self-replicating malware. Technical analysis reveals credential harvesting, GitHub Actions exploitation, and worm-like propagation affecting 25,000+ repositories. Includes IOCs, detection methods, and remediation steps.