September 2025 marked a watershed moment for supply chain security when the Shai-Hulud worm became the first self-replicating malware to propagate through the npm ecosystem. This post examines how Qpoint's eBPF-based data-in-motion security would have detected this attack at the moment of compromise.