Is spectral impacted by npmjs worm?

[golangcyberdude]

https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem

CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.[i]

After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]

[golangcyberdude]

197noat.txt
Checked the 40 here also https://www.truesec.com/hub/blog/500-npm-packages-compromised-in-ongoing-supply-chain-attack-shai-hulud

I collated the known compromised packages and remove the @ sign.

Then checking the spectral package.json and yarn.lock, no matches are found. 👍Please confirm my findings.

for P in cat 197noat ; do grep $P package.json yarn.lock ; done

[golangcyberdude]

Checking these ~500 500noat.txt

https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages

~/SPECTRAL_ANALYSIS$ for P in cat 500noat; do grep $P package.json yarn.lock ; done
Nothing found