A new wave of Shai-Hulud malware has compromised over 500 npm packages, exposing developer secrets and impacting key players like Zapier, ENS Domains, Postman, and AsyncAPI.
Quick Summary – TLDR:
- More than 500 npm packages were infected with a self-replicating malware called Shai-Hulud.
- The malware steals developer and CI/CD secrets and publishes them to GitHub.
- Major projects affected include packages from Zapier, PostHog, ENS Domains, and Postman.
- Over 27,000 GitHub repositories were created to store leaked secrets, signaling widespread compromise.
What Happened?
Security researchers uncovered a large-scale supply chain attack over the weekend where attackers uploaded trojanized versions of popular npm packages. These packages were modified to include malicious scripts that ran during installation, giving attackers access to machines and sensitive data. The stolen secrets were then posted on public GitHub repositories labeled with the description “Sha1-Hulud: The Second Coming.”
🔥 New npm attack DETECTED!
— The Hacker News (@TheHackersNews) November 24, 2025
A campaign dubbed “Sha1-Hulud: The Second Coming” has compromised hundreds of packages and over 25,000 GitHub repos.
The code runs during install, steals cloud logins, and if that fails, it deletes the user’s home folder.
Read more ↓… pic.twitter.com/yhdbQJVWkI
Inside the Shai-Hulud Campaign
The malware, Shai-Hulud, named after the sandworms from the sci-fi novel Dune, is designed as a self-replicating worm. It targets developers and automation systems by:
- Infecting popular packages using compromised maintainer accounts.
- Using the setup_bun.js script to install Bun and then triggering bun_environment.js, which contains the malicious payload.
- Employing tools like TruffleHog to scan systems for API keys, tokens, and cloud credentials.
- Creating GitHub repositories with random names to exfiltrate data.
Technical Details
- The malware is spread through a staging script called setup_bun.js, disguised as a Bun installer.
- It executes a 10MB obfuscated payload in bun_environment.js, using anti-analysis techniques.
- Once activated, it attempts to harvest sensitive files like:
- cloud.json
- contents.json
- environment.json
- truffleSecrets.json
If the malware cannot connect to GitHub or npm, it has a destructive fallback: deleting the user’s entire home directory.
Scale of Impact
- Over 492 npm packages have been confirmed compromised, many with millions of downloads per month.
- Affected packages include:
- @zapier/mcp-integration
- @posthog/nextjs
- @asyncapi/cli
- @postman/secret-scanner-wasm
- Various packages from ENS Domains
- GitHub currently hosts more than 27,600 repositories linked to stolen credentials, showing how wide the damage has spread.
Who Is Affected?
Projects and teams using any of the impacted npm packages are at risk. Attackers exploited weaknesses in dependency chains and maintainer tokens just ahead of npm’s deadline to revoke classic tokens, making this a strategic strike.
Security researchers from Aikido Security, Wiz, and Step Security tracked the attack and confirmed its multi-platform nature, affecting Windows, Linux, and macOS systems.
What Should Developers Do Now?
- Audit all dependencies from Zapier, ENS, Postman, and others mentioned in the attack.
- Rotate all credentials used during package installations, especially GitHub and cloud secrets.
- Check GitHub for suspicious repositories named with “Sha1-Hulud: The Second Coming.”
- Disable postinstall npm scripts in CI/CD pipelines where feasible.
- Enforce multi-factor authentication (MFA) and use tools like Safe-Chain to block malicious npm packages.
SQ Magazine’s Takeaway
As someone who follows developer security closely, this incident is frankly terrifying. A worm that steals secrets and spreads itself silently through trusted packages is every dev team’s worst nightmare. What makes it worse is how fast it all happened and how deeply it affected major names in our ecosystem. This attack is a loud wake-up call. If your CI/CD or dev systems rely on open-source packages from npm, now’s the time to double down on dependency hygiene, MFA, and auditing. Trust in open-source is essential, but so is verification.
