Shai-Hulud npm Supply Chain Attack

Another major supply-chain attack via compromised npm maintainer account, using valid provenance from GitHub Actions to evade detection. Preinstall scripts, Bun runtime dropper, credential theft from cloud/K8s/Vault. Distinct from Injective Labs; reinforces need for stronger account security and provenance verification beyond just signing.