On 15 September 2025, several security researchers discovered a self-replicating worm on the npm open-source registry, named ‘Shai-hulud’. Infected versions include a self-propagating mechanism that primarily targets other packages by the same maintainer, focusing on stealing and exfiltrating secrets, credentials, and tokens embedded within those packages. We’ve sent out a Threat Response for this on 17 September 2025. On 24 November 2025 a second strike occurred with an upgraded version of the attack, which infects considerably more npm packages than in the first wave.
Description
The attack appears to be part of an ongoing malicious supply chain campaign known as the ‘Shai-hulud attack’. The start date of the second campaign appears to be 24 November 2025. Around 700 npm packages are compromised by this attack as of today. This wave has grown exponentially in its impact to already over 27.000 compromised systems. This number still rises by around 1000 new systems every 30 minutes, shown in the creation of as many new repositories where the developers' sensitive information is uploaded by the worm.
The npm packages are being compromised through an auto-spreading functionality that adds a postinstall script to the package.json file. This script, named bundle.js, downloads and runs TruffleHog, an open-source tool used to search hosts for tokens and cloud credentials. The script validates and uses developer and CI credentials, creates a GitHub Actions workflow inside repositories, and exfiltrates results to a hardcoded webhook: webhook[.]site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7.
The second wave uses the setup_bun.js file to install bun and then uses that to execute bun_environment.js, which is the main malicious payload. Once infected, the malware will exfiltrate secrets for Github and npm tokens, as well as secrets for cloud platforms like AWS, GCP and Azure. It also has gained destructive impact as it will activate a shredder component on non-CI Linux hosts to erase traces. The shreddder wipes all files in the home directory of the hosts.
Impact
We assess the impact of this attack as high, as multiple well-known and widely used npm packages have been compromised. This has led to the large-scale exfiltration of secrets and tokens from development environments by a threat actor.
Risk
The risk level is also considered high, due to the popularity of the affected npm packages and the worm’s active spreading mechanism, which could result in more packages being compromised in the coming days.
Mitigation
Please take the following steps to mitigate the risk:
-
First, make sure no developer in your organisation pulls in npm packages for now. Even if you are not infected yet, new packages are still being infected, so for now npm is not safe to use.
-
Block outbound connections to webhook[.]site domains.
-
Check the lists provided by aikido.dev [1] and socket.dev [2] to verify if any compromised packages are used in your software dependencies.
-
If affected, follow these remediation steps:
-
Audit CI/CD agents and developer machines for the presence of compromised packages.
-
Uninstall compromised packages and pin known-good versions. Do not update npm packages until verified patches are released.
-
Review and remove unnecessary GitHub Apps and OAuth applications.
-
Check deploy keys and repository secrets for all projects.
-
Audit all repository webhooks for unauthorized additions.
-
Reset all tokens, secrets, and credentials, as they should be considered compromised.
-
If developers are also maintainers of npm repositories, monitor logs for unusual npm publish or package modification events.
-
It is hard to say at what point npm will be safe to use again. Classic tokens will be revoked on 9 December across the npm ecosystem, after which date only the new granular access tokens system will work. This should protect the npm ecosystem against attacks like these. However, most likely the propagation of this worm will die out before that date – keep track of aikido.dev[1] to stay current.
What Should You Do?
We recommend implementing the above mitigation steps as soon as possible. Please also inform developers and maintainers that npm packages are currently being actively infected. This means that new versions of their dependencies could become compromised in the coming days. We advise monitoring the list provided by aikido.dev [1] and socket.dev [2] to stay updated on newly discovered compromised packages.
Additionally, we recommend implementing regular credential rotation policies and using separate, limited-scope tokens for CI/CD pipelines to minimize potential risk.
What Will Northwave Do?
We will continue to monitor developments related to this attack. If new critical information arises, we will contact you. If you would like additional information, please feel free to call us or send an email.
E-mail: soc@northwave-cybersecurity.com
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
Do you have an incident right now? Call our Incident Response Team: 00800 1744 0000
Disclaimer applies, see below.
Sources
[1]: https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
[2]: https://socket.dev/blog/shai-hulud-strikes-again-v2
[3]: https://thecyberexpress.com/crowdstrike-hit-in-npm-attack/
[4]: https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
[5]: https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/
[2]: https://socket.dev/blog/shai-hulud-strikes-again-v2
[3]: https://thecyberexpress.com/crowdstrike-hit-in-npm-attack/
[4]: https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
[5]: https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/