The npm package @trackunit/iris-app-sdk-vite version 1.2.10-alpha-d785aff3531.0 includes a dependency on cross-keychain, a malicious package linked to the Shai-Hulud npm worm campaign. This campaign uses install-time lifecycle hooks to harvest developer credentials such as npm tokens, GitHub tokens, and cloud credentials, and self-propagates by republishing tainted versions under the victim's identity. The affected version exhibits an anomalous alpha-tag pattern consistent with other compromised releases during the incident window, indicating it is not a legitimate release.