Skip to content

Incident · Resolved

Shai-Hulud npm Worm

3 stories since SEP 16

3
stories
NOV 24
latest
Product
npm
First reported
Sep 16, 2025
Latest
Nov 24, 2025

How it unfolded

Decipher story Event

  1. New Automated npm Attack Campaign Targets Dozens of Packages
  2. GitHub Aims to Improve npm Security After Malware Campaigns
  3. New Shai Hulud NPM Worm Emerges

The story so far

Shai-Hulud is a self-spreading worm that takes over npm packages and steals developers’ tokens and secrets. It first hit dozens of packages in September 2025, including some published from CrowdStrike’s account, and GitHub responded with stricter publishing rules. A more aggressive version appeared in November, reaching packages from Zapier, Postman and others and more than 25,000 repositories.

Written by the editors

Timeline · 3 stories

Oldest first ↓
  1. AINew Automated npm Attack Campaign Targets Dozens of PackagesThe campaign does not appear to be connected to the previous npm phishing attacks, but it does seem to be related to a rash of GitHub and npm token and secret thefts from the end of August.DENNIS FISHER · 3 MIN
  2. Supply ChainGitHub Aims to Improve npm Security After Malware CampaignsGitHub said the changes will help “fortify the security of the software supply chain” after a recent surge of attacks targeting the npm ecosystem.LINDSEY O'DONNELL-WELCH · 4 MIN
  3. IntrusionsNew Shai Hulud NPM Worm EmergesResearchers from Wiz are currently tracking more than 25,000 affected repositories across approximately 350 unique users.DENNIS FISHER · 2 MIN

Newsletter

The Decipher Brief

Every week: the stories, the episode, the clips.

Newsletter sign-up is coming soon.