The Shai-Hulud Worm: How 500+ NPM Packages Became Credential-Stealing Malware

In September 2025, security researchers discovered something unprecedented: a self-replicating worm spreading through the NPM package ecosystem, stealing developer credentials and automatically infecting more packages. Named "Shai-Hulud" after the giant sandworms from Dune, this attack represents a new era in supply chain security—and a warning about how quickly stolen credentials can cascade into catastrophe.

What is Shai-Hulud?

Shai-Hulud is the first successful worm attack in the NPM ecosystem. Unlike traditional malware that requires manual deployment, this worm spreads autonomously by stealing developer credentials and using them to infect additional packages.

Here's what makes it terrifying:

• Self-replicating: When the malware finds NPM tokens on a compromised machine, it automatically publishes malicious versions of any packages that developer maintains
• Exponential spread: Each new infection creates more infections, without any attacker involvement
• Credential harvesting: The malware steals AWS, GCP, Azure credentials, GitHub tokens, SSH keys, and more
• Destructive fallback: If exfiltration fails, the malware attempts to destroy the victim's entire home directory

The Timeline: How It Unfolded

September 2025: First Wave

The initial campaign was discovered when security researchers noticed suspicious activity in popular NPM packages. The attack spread through phishing emails impersonating NPM, tricking developers into revealing their credentials.

Key impacts:

• 500+ packages compromised including packages associated with CrowdStrike
• @ctrl/tinycolor with over 2 million weekly downloads was infected
• 40+ packages across multiple maintainers compromised in the initial wave

November 2025: Shai-Hulud 2.0

A more aggressive second wave emerged, with researchers from Unit 42 and JFrog documenting the expanded attack:

• 25,000+ malicious repositories across approximately 350 unique GitHub users
• Pre-installation execution: Unlike the first wave (post-install), the new variant executes during pre-install, dramatically widening the attack surface
• Notable victims: Packages from Zapier, ENS Domains, PostHog, and Postman were affected
• GitHub Actions backdoors: The malware drops workflow files that serialize and exfiltrate secrets

According to CISA's alert, this attack affects "tens of thousands" of GitHub repositories.

How the Attack Works

Step 1: Initial Compromise

Developers receive phishing emails that appear to come from NPM, requesting MFA credential updates. Those who fall for the phishing attack inadvertently grant attackers access to their NPM accounts.

Step 2: Package Infection

The attacker publishes a malicious version of a package the compromised developer maintains. This version includes hidden code in the installation scripts.

Step 3: Credential Harvesting

When someone installs the infected package, the malware scans for:

Credential type	Location scanned
NPM tokens	.npmrc files
GitHub tokens	Environment variables, config files
Cloud credentials	AWS, GCP, Azure credential files
SSH keys	~/.ssh directory

The malware uses TruffleHog to systematically find secrets across the filesystem.

Step 4: Autonomous Spreading

Here's where Shai-Hulud becomes unique: the worm uses stolen NPM tokens to identify other packages the victim maintains, then publishes malicious versions of those packages too—all without any human attacker involvement.

Developer A gets phished → Package X infected → 
Developer B installs Package X → Package Y, Z infected (B's packages) → 
Developer C, D, E install Y or Z → More packages infected...

Step 5: The Dead Man's Switch

If the malware's exfiltration channels are blocked, it triggers a destructive fallback that attempts to securely overwrite and delete all writable files in the user's home directory. This "scorched earth" approach ensures maximum damage even if the attack is partially blocked.

Why This Matters for Everyone (Not Just Developers)

You might think: "I'm not a developer. Why should I care about NPM packages?"

Here's why: the credentials stolen in Shai-Hulud attacks are the same credentials used to access your data.

When attackers steal:

• AWS credentials → They can access databases containing user information
• GitHub tokens → They can insert backdoors into software you use
• Cloud API keys → They can access infrastructure running applications you depend on

The companies affected by Shai-Hulud—like Zapier, PostHog, and Postman—handle data for millions of users. A compromised developer credential can cascade into:

• User database breaches
• API key theft
• Payment information exposure
• Personal data leaks

How to Protect Yourself

If You're a Developer

CISA's mitigation recommendations include:

• Immediately rotate all credentials: NPM tokens, GitHub PATs, SSH keys, cloud API keys
• Audit dependencies: Run npm audit and examine your package-lock.json files
• Check for Shai-Hulud repositories: Look for unfamiliar repositories in your GitHub account with "Shai-Hulud" in the description
• Enable MFA everywhere: GitHub, NPM, and all cloud providers
• Pin dependency versions: Lock versions to known-safe releases prior to September 16, 2025

If You're a Regular User

Even if you're not a developer, you should:

• Use unique passwords for every account: If one password is compromised, only one account is affected
• Enable 2FA on important accounts: Email, banking, anything with sensitive data
• Check for breaches: Visit Have I Been Pwned to see if your credentials have been exposed
• Change passwords on breached accounts: Don't wait—attackers act quickly

The Password Rotation Problem

Here's the uncomfortable truth: most people know they should change compromised passwords. Most people don't do it.

Why? Because changing passwords manually is tedious. If you have 100+ accounts and 30 of them use a compromised password, that's hours of work navigating to each site, finding the password change form, generating a new password, and updating your password manager.

This is exactly why we built The Password App: to automate the tedious part of credential hygiene so you actually get it done.

Lessons from Shai-Hulud

1. Supply Chain Attacks Are Escalating

Shai-Hulud represents a new sophistication in supply chain attacks. The self-replicating nature means a single successful phishing email can cascade into thousands of compromised packages—and millions of affected users downstream.

2. Credential Hygiene Matters More Than Ever

Every compromised credential is a potential entry point. Whether it's a developer's NPM token or your Netflix password, reused or weak credentials multiply risk.

3. Automated Attacks Require Automated Defenses

Attackers use automation to scale their efforts. Individual users and organizations need automation to keep up. Manually rotating 100 passwords after every breach isn't sustainable.

Take Action Today

The Shai-Hulud worm is a wake-up call. Supply chain attacks are getting more sophisticated, and credential theft cascades further than ever before.

You may not be able to control whether the software you use gets compromised. But you can control:

• Your own credential hygiene: Unique passwords, 2FA enabled
• Your response time: Change compromised passwords quickly
• Your attack surface: Fewer reused passwords means less blast radius

Your credentials are only as secure as your weakest password. Make them all strong.

---

Sources

• Unit 42: Shai-Hulud Worm Compromises npm Ecosystem
• JFrog: Shai-Hulud npm supply chain attack
• CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem
• Truesec: 500+ npm Packages Compromised

---

Originally published at thepassword.app/blog