Shai-Hulud 2.0: a second wave, 796 npm packages infected in a day

2025-11-24 · Publisher : npm · Domain : Cloud & DevOps

On 24 November 2025, a second wave of Shai-Hulud compromises 796 npm packages (over 20 million weekly downloads). It runs at pre-install time and can wipe the victim's home directory.

### Background On 24 November 2025, researchers detect a second wave of the Shai-Hulud worm, nicknamed "Shai-Hulud 2.0" or "the Second Coming". According to Datadog Security Labs, it compromises 796 unique npm packages, 1,092 versions in all, totalling more than 20 million weekly downloads. ### Key facts - The code runs at pre-install time and installs the Bun runtime, probably to evade Node.js monitoring tools. - It harvests credentials from disk, from cloud metadata services (AWS, Azure, GCP) and from secret managers. - Data is published to public GitHub repositories described as "Sha1-Hulud: The Second Coming". - Datadog counts more than 500 GitHub users and over 150 organizations affected; Zapier, ENS Domains and PostHog are among the victims. - As a last resort, if exfiltration or propagation fails, the code tries to delete the user's home directory. ### Why it matters The November wave shows that the September response was not enough: the worm came back faster and more destructive. It directly targets CI runners and cloud environments, abusing npm lifecycle scripts. Teams that had not disabled install scripts by default, nor limited the secrets exposed to jobs, were the most vulnerable. The wave comes two months after the first and two months after GitHub announced its npm hardening plan, whose measures were to be rolled out gradually. ### Takeaway The worm returns in November, broader and more destructive: disabling install scripts and limiting secrets becomes imperative.

Tags : Sécurité, CI/CD, Open Source, DevOps