Shai-Hulud: a self-replicating worm hits more than 500 npm packages

2025-09-16 · Publisher : npm · Domain : Cloud & DevOps

In mid-September 2025, the Shai-Hulud worm infects more than 500 npm packages. It steals tokens and cloud keys, publishes them to public GitHub repositories and spreads by republishing its victims' packages.

### What changes From 15-16 September 2025 (GitHub dates the attack to the 14th), the Shai-Hulud worm spreads through the npm ecosystem. A script run when an infected package is installed searches for secrets, exfiltrates them to a public GitHub repository, then uses the npm tokens found to publish new booby-trapped versions of the victim's packages. More than 500 packages are affected. ### Key facts - According to CISA (23 September alert), the code targets GitHub personal access tokens and AWS, GCP and Azure API keys. - According to Kaspersky Securelist, it uses the TruffleHog tool to look for secrets, creates "shai-hulud" branches with a workflow stealing repository secrets, and modifies up to 20 of each victim's most downloaded packages. - Packages cited: @ctrl/tinycolor (over 2 million weekly downloads) and nine @crowdstrike packages. - On 22 September, GitHub announces an npm hardening plan: local publishing with 2FA, 7-day granular tokens or trusted publishing, retirement of classic tokens. - CISA recommends pinning versions prior to 16 September, rotating all credentials and enforcing phishing-resistant MFA. ### Why it matters This is the first large-scale worm attack on the software supply chain: a single compromised developer or CI machine multiplies infected packages without further action from the attacker. Developer workstations and CI runners have become prime targets. For teams, the response is organizational: lock dependencies, reduce secrets in CI, enforce MFA and monitor install-script execution. ### Takeaway A worm on npm changes the scale of the risk: one compromised machine can contaminate the ecosystem within hours.

Tags : Sécurité, CI/CD, Open Source, DevOps