Documented incidentDisclosed 2025-09-23npm ecosystemGovernment security alert

Self-replicating "Shai-Hulud" worm compromises more than 500 npm packages by stealing developer tokens (2025)

CISA reported that a self-replicating worm known as "Shai-Hulud" had compromised more than 500 npm packages.

What happened

  • The malware scanned environments for credentials such as GitHub personal access tokens and AWS, Google Cloud and Azure API keys, sent them to the actor and also uploaded them to public GitHub repositories.Widespread Supply Chain Compromise Impacting npm Ecosystem
  • It spread by authenticating to npm as the compromised developer, injecting code into that developer's other packages and publishing new versions; CISA advised rotating all developer credentials and requiring phishing-resistant MFA.Widespread Supply Chain Compromise Impacting npm Ecosystem

The failure pattern

Weak or phishable authentication on a privileged pathA password, an SMS code or a help-desk reset is all that stands between an attacker and admin access.How to prevent it Insufficient segmentation lets a foothold spreadOne compromised account, vendor or network segment reaches management planes, backups and everything else.How to prevent it
Watch the pattern: Weak or phishable authentication on a privileged path

Safeguards that address it

CollectSEA's engineering analysis of what would have prevented or contained this failure.

  • Keep publishing credentials out of developer environmentsUse short-lived, scoped publishing tokens or trusted publishing, so malware on a laptop or CI runner cannot republish packages.
  • Pin and review dependency updatesInstall from a lockfile, delay adopting brand-new package versions and block install scripts where possible.

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern