Is My Site Secure

npm · disclosed 15 September 2025

Shai-Hulud self-replicating npm worm (first wave)

Shai-Hulud was the first widely reported self-spreading worm on npm. Infected package versions gained a postinstall script that ran a bundled file (bundle.js) whenever a developer or CI system installed the package. The script used TruffleHog and environment scanning to steal GitHub, npm and cloud (AWS, GCP, Azure) credentials. It posted the stolen data to public GitHub repos named 'Shai-Hulud' and to a webhook.site URL, and planted a GitHub Actions workflow to keep exfiltrating. With any npm tokens it found, it injected itself into the victim's other packages and republished them, which is how it spread to more than 500 packages, including @ctrl/tinycolor and several @crowdstrike packages.

  • Detectable by a website scanNo, server-side only
  • Last reviewed23 October 2026

Timeline

  1. First malicious versions are published, beginning at about 17:58 UTC (rxnt-authentication@0.0.3 per Socket). GitHub says it was notified of the attack the same day.
  2. StepSecurity and others report @ctrl/tinycolor (4.1.1, 4.1.2) and 40+ other compromised packages.
  3. At about 01:14 UTC, a burst of nearly 100 packages, including @crowdstrike scoped packages, is republished with the worm (Socket). Wiz publishes its analysis.
  4. GitHub says it removed more than 500 compromised packages, blocked uploads containing the malware's indicators, and announces npm publishing hardening.
  5. CISA issues an alert saying the worm compromised over 500 packages, and advises pinning to releases from before Sept 16, 2025 and rotating developer credentials.

Affected packages

PackageAffected versions
@ctrl/tinycolor4.1.1, 4.1.2
ngx-bootstrap18.1.4, 19.0.3, 19.0.4, 20.0.3, 20.0.4, 20.0.5, 20.0.6
angulartics214.1.1, 14.1.2
@crowdstrike/commitlint8.1.1, 8.1.2
@nativescript-community/sqlite3.5.2, 3.5.3, 3.5.4, 3.5.5
rxnt-authentication0.0.3, 0.0.4, 0.0.5, 0.0.6

More than 500 packages: GitHub says it removed 'over 500 compromised packages' (2025-09-22), and CISA says 'over 500 packages' (2025-09-23). Socket's IOC list had 526 package@version entries as of its 2025-09-16 update. Early reports said '40+' (StepSecurity's first summary) and '187' (press), and grew as the worm spread. Versions above match the OSV/OpenSSF malicious-package records (MAL-2025-47141, -47197, -47172, -47233, -47150, -47345).

What to do

  1. Check lockfiles, including transitive dependencies, and any artifact caches for affected versions. Pin to releases published before 2025-09-16 (CISA guidance).
  2. If an affected version was ever installed on a build machine, CI runner or developer laptop, treat it as compromised. Rotate npm tokens, GitHub tokens, SSH keys and cloud credentials, plus any secrets your site's build or deploy pipeline can reach.
  3. In your GitHub account and org, look for repos named 'Shai-Hulud', repos with a '-migration' suffix or 'Shai-Hulud Migration' description, a 'shai-hulud' branch, and .github/workflows/shai-hulud-workflow.yml. Remove them after capturing evidence.
  4. Audit your deployed site for unexpected changes made with stolen credentials, such as new deploy keys, workflows or commits, since the worm targeted the CI and hosting secrets used to publish sites.
  5. Turn on phishing-resistant MFA for npm and GitHub, prefer trusted publishing over long-lived tokens, and consider running installs with --ignore-scripts in CI.

Sources

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.