The Shai Hulud npm worm has re-emerged, launching an aggressive new assault on the software program improvement world. This worm, which Hackread.com first reported in September 2025, returned this Monday, November 24, 2025, hanging with dramatically elevated depth. This timing is notable because it happens simply earlier than npm’s December 9 deadline to revoke outdated basic entry tokens.
In September, the Shai Hulud assault compromised about 180 software program libraries (repositories). Nonetheless, safety researcher Charlie Eriksen from Aikido Safety detected the brand new wave early this morning (5:10 AM CET), seeing contaminated code tasks skyrocket to over 19,000 in just some hours. This represents a hundred-fold improve over the earlier marketing campaign.
Compromised Instruments and Sooner Assaults
The assault started with packages like go-template and 36 packages from AsyncAPI, shortly adopted by these from PostHog and Postman. Among the many first wave of over 60 compromised packages have been the primary instruments for providers like Zapier and the ENS platform. Particular affected gadgets embrace packages similar to @zapier/zapier-sdk, zapier-platform-core, @ensdomains/ensjs, ethereum-ens, and typeorm-orbit.
This new model of Shai Hulud is quicker and extra harmful as a result of the attackers realized from their earlier try. They’ve streamlined their course of for sending stolen knowledge, “ditched the webhook bottleneck and now dump credentials straight to public GitHub repos,” explains Eriksen within the weblog put up shared with Hackread.com.
The malware’s main aim is to steal credentials (delicate entry codes) from builders’ computer systems. In keeping with Aikido’s investigation, these embrace vital entry keys for main cloud providers like Amazon Net Providers (AWS), API keys, and tokens for platforms like GitHub and npm.
Victims Turn out to be Threats
The malware robotically scans each the native pc and linked cloud accounts and makes use of the TruffleHog instrument to “ransack developer machines” for each secret it may discover. The an infection turns victims into rapid threats, as any stolen npm or GitHub keys are immediately used to compromise extra packages. This implies every sufferer turns into “an assault vector in real-time,” making it the quickest response ever recorded within the software program provide chain.
Regardless of the size, the assault’s general influence was restricted: the attackers made errors, because the core malicious file bun_environment.js generally did not bundle. The harm continues to be huge, nonetheless. In complete, 425 packages have been detected with indicators of the brand new worm.
Over 19,000 public code repositories now comprise stolen credentials, recognized by the title “Sha1-Hulud: The Second Coming” within the description, and a complete of over 26,300 repositories have been uncovered. These affected packages have a mixed complete of 132 million month-to-month downloads (test the total record right here).
Fast Actions for Builders
The most recent menace follows intently after researchers took down a faux model of the Prettier code formatter extension on the VSCode Market, which had delivered Anivia Stealer in one other developer-targeted assault.
This exhibits how builders are at all times the prime goal of cyber criminals. To deal with the Shai Hulud menace, they need to instantly uninstall compromised packages, rotate all credentials (GitHub, npm, cloud, and CI/CD secrets and techniques), audit dependencies, test GitHub for unusual repos with the “Sha1-Hulud: The Second Coming” description, disable npm postinstall scripts in CI, and implement MFA on all accounts.
