← Back to Blog

The Spice Must Flow: Inside the “Shai-Hulud” NPM Worm Attack

A self-propagating malware dubbed “Shai-Hulud” has infiltrated the npm ecosystem and compromised over 180 packages. It steals credentials and spreads from package to package on its own, and the number of affected packages is still growing. The name “Shai-Hulud” is a reference to the giant sandworms in the Dune novels, likely because the malware creates public GitHub repositories with “Shai-Hulud” in the name to exfiltrate stolen data.

A multi-stage attack

The Shai-Hulud worm executes a multi-stage attack that begins when a developer installs a compromised npm package. The attack is believed to be the work of the same threat actors behind the recent S1ngularity/nx attack.

The attack unfolds in five stages:

  1. Initial Compromise: The attack likely started with a phishing campaign that tricked a package maintainer into giving up their credentials. The first package identified as compromised was rxnt-authentication, which was updated with the malicious code on September 14, 2025.
  2. Execution: The malware is contained in a bundle.js script that runs automatically after the compromised package is installed. This script targets Linux and macOS systems.
  3. Credential Theft: The worm uses trufflehog, a legitimate open-source tool, to scan the infected system for sensitive information. It searches for credentials for GitHub, npm, AWS, and GCP.
  4. Data Exfiltration: Stolen credentials and other sensitive data are then exfiltrated to a public GitHub repository and a webhook.site endpoint. The malware can also make private GitHub repositories public, which exposes more sensitive information.
  5. Self-Propagation: This is the most alarming part of the attack. If the worm finds valid npm credentials, it identifies other packages maintained by the compromised developer and injects itself into them. It then publishes new versions of these packages, which lets the worm spread exponentially through the npm ecosystem.

Widespread impact, even on security firms

The Shai-Hulud worm has compromised over 180 packages so far, and that number is expected to grow. Some of the popular packages affected include @ctrl/tinycolor, angulartics2, and ngx-toastr.

Ironically, even the cybersecurity firm CrowdStrike was not immune to this attack. The worm compromised over 20 of CrowdStrike’s npm packages. CrowdStrike has since removed the malicious packages and rotated its keys. The firm said its Falcon platform and customers were not impacted.

How to Protect Yourself

This attack shows how much damage a single compromised package can do. Here are some steps you can take to protect yourself from similar attacks:

  • Audit your dependencies. Review the packages you are using and remove any that are no longer necessary.
  • Use lock files. Pin your dependencies to specific versions to prevent unexpected updates.
  • Scan for vulnerabilities. Set up automated dependency scanning and monitoring to detect unauthorized activities.
  • Rotate credentials. If you suspect you may have been compromised, rotate all of your credentials immediately.
  • Review security logs. Check your GitHub security logs regularly for any suspicious activity, such as the creation of new repositories.
  • Be wary of phishing. If an email or other communication asks you to update credentials or perform other sensitive actions, treat it as suspicious.

The Shai-Hulud worm is a serious threat to the npm ecosystem, but by taking proactive security measures, you can help protect yourself and your organization from this and other supply chain attacks.

Sources

“Shai-Hulud” Worm Compromises npm Ecosystem in Supply Chain Attack - Ox.Security
S1ngularity/nx attackers strike again - Aikido Security