Home / Cybersecurity

Shai-Hulud Returns: The npm Worm That Leaked Secrets From 25,000 Repositories

A faster second wave of the self-spreading npm worm hit Zapier, PostHog and Postman packages, and pushed GitHub and npm to rework authentication.

CybersecurityNov 24, 20254 min read2 diagrams

Key takeaways

  • Wiz counted 25,000+ GitHub repositories holding stolen secrets within about three days, growing by roughly 1,000 every 30 minutes.
  • The malicious code now runs at pre-install, not post-install, raising the odds it executes in builds.
  • npm moved to revoke classic tokens on 9 December and shift authentication toward FIDO-based methods.

The npm ecosystem's self-replicating worm is back. Starting around 21 November 2025, a second wave of Shai-Hulud trojanized packages from Zapier, AsyncAPI, ENS Domains, PostHog and Postman, and by 24 November Wiz had counted more than 25,000 GitHub repositories spilling stolen developer secrets.

What happened

The first Shai-Hulud wave appeared in September 2025 and infected more than 500 packages. This one is faster and meaner. Attackers take over npm maintainer accounts and publish tampered versions that look official. Anyone who installs one runs code that hunts the machine for AWS, GCP, Azure and GitHub credentials plus CI/CD secrets, then publishes the haul to repositories created under the victim's own GitHub account. Wiz said more than 25,000 developers had secrets exposed within three days, with about 1,000 new repositories appearing every 30 minutes at the time of its count.

Counts differ by vendor. Check Point tallied 621 infected npm packages, while Wiz identified about 350 unique npm accounts involved. The attackers' identity is unknown, and Wiz said some of the latest activity may be copycats.

How the Shai-Hulud worm propagates Maintainer account taken over Trojanized package published Dev installs it runs at pre-install Secrets scraped cloud keys, tokens Dumped to public GitHub repos Stolen npm tokens publish more infected packages (loop) Worm propagation loop
Simplified propagation path of the Shai-Hulud worm. Illustrative.

What changed in version 2.0

The key shift is timing. The malicious code now runs in the pre-install phase rather than after installation, which Wiz warned could significantly widen exposure in build and runtime environments. Mnemonic's advisory also noted a destructive fallback: if the malware fails to steal credentials, it tries to delete writable files in the user's home folder. Telltale signs of compromise include new GitHub repositories with "Shai-Hulud" in the description and unexpected npm publications from your own account.

Infected npm packages reported in wave one versus wave two Infected npm packages by wave Vendor counts differ; wave one is a floor ("more than 500") Sept 2025 500+ Nov 2025 621 Bars scaled to 621 max.
Package counts as reported by The Register (wave one) and Check Point (wave two); other vendors report higher totals.

Why it matters

A worm that lives in developer tooling attacks the place where companies keep their keys. Stolen cloud and CI credentials do not expire when a bad package is pulled, so cleanup means rotating secrets, not just deleting dependencies. The platforms responded: GitHub moved npm away from time-based one-time-password 2FA toward FIDO-based authentication, and npm said it would stop creating classic tokens and revoke all existing ones on 9 December.

Who was hit, and how defenders responded

The named package families, from Zapier, AsyncAPI, ENS Domains, PostHog and Postman, matter because they are widely embedded in build graphs. A developer who never heard of the affected package could still have pulled it in as a transitive dependency, which is exactly how worm-style npm incidents travel. The Register reported that the attacks began on 21 November and that affected packages had been trojanized by 23 November, so the window between first publication and public warning was only a few days, yet the damage compounded fast because each infected maintainer could publish further infected packages.

Platform operators had already been moving. After the September wave, GitHub announced a tightening of npm publishing: classic tokens would be phased out, long-lived credentials discouraged, and two-factor authentication shifted from time-based codes, which can be phished, toward FIDO-based methods. The November wave added urgency to that plan. It also highlights a long-standing weakness: a package registry is only as strong as the weakest maintainer account that can publish to it, and a single compromised laptop can expose every project that person maintains.

For engineering teams the checklist is concrete. Pin dependencies to known-good versions and use lockfiles. Where feasible, disable install scripts by default and allow them only for packages that truly need them. Keep CI secrets short-lived and scoped, preferably via federated identity rather than stored keys. Treat any machine that installed an affected version as compromised until credentials have been rotated, and search your organisation's GitHub for unexpected new repositories, since that is where the worm leaves its stolen data.

What to watch

  • Roll back to dependency versions published before 21 November, clear caches and rotate every credential that touched an affected build.
  • Whether npm's token and authentication changes slow later copycats; this wave was not the last.
  • Adoption of install-script restrictions and pinned dependencies in CI pipelines.

Sources

  1. Shai-Hulud worm returns, belches secrets to 25K GitHub repos — The Register
  2. Shai-Hulud 2.0: Inside The Second Coming — Check Point Research
  3. Advisory: Shai-Hulud 2.0 supply chain campaign — mnemonic

More in Cybersecurity