Supply-Chain Worms Persist on GitHub While Victims Face Automated Punishment

The Shai-Hulud worm outbreak reveals a critical gap in developer security practices: most infected repositories remain vulnerable a week later because owners don't understand how to properly remove malicious code from Git history. More troubling, GitHub's automated takedown responses punish the victims themselves while payloads persist, and developers attempting cleanup via AI tools or IDEs risk re-triggering the infection. This highlights the urgent need for smarter incident response that educates and assists rather than simply disables.