Zscaler Blog
Get the latest Zscaler blog updates in your inbox
On September 15th 2025, ReversingLabs (RL) researchers discovered a self-replicating worm called “Shai-Hulud” in the npm open-source registry. The worm autonomously spreads through the npm registry by hijacking maintainer accounts and injecting malicious code into public and private packages. Over 200 npm packages and more than 500 versions were compromised between September 14th and 18th. Each infected package helps the Shai-Hulud worm spread further which creates a chain reaction across the npm ecosystem.
Named after its repository, the Shai-Hulud worm targets sensitive data like tokens, keys, and private repositories. While end-user applications are less directly affected, build environments may have been exposed through leaked credentials or code. RL has identified hundreds of compromised packages, including widely used ones like ngx-bootstrap, ng2-file-upload, and @ctrl/tinycolor, which have millions of weekly downloads. The interconnected nature of npm packages makes it difficult to predict the worm’s impact.
npm publish events, GitHub workflow additions, or the unexpected use of secret scanners in CI processes. Hunt for indicators of compromise (IOCs) like bundle.js, workflows named shai-hulud-workflow.yml, or outbound traffic to webhook[.]site.npm, GitHub, and cloud services.Notable examples of compromised packages and their versions include:
All major operating systems (OS), including Windows, Linux, and macOS, are affected and become vulnerable when compromised npm packages are installed.
The Shai-Hulud worm exploits compromised npm packages by planting a malicious post-install script. When executed, the script executes several actions:
This combination of credential theft, package trojanization, and self-replication makes the Shai-Hulud worm uniquely dangerous.
The Shai-Hulud worm rapidly compromised hundreds of npm packages and versions across Windows, Linux, and macOS, showing how quickly and widely vulnerabilities in open-source ecosystems can be exploited. By combining credential theft, automated propagation, and repository tampering, the Shai-Hulud worm has set a precedent for future supply chain attacks. To prevent similar incidents, organizations must act immediately by revoking exposed credentials, strengthening supply chain defenses, and implementing enhanced monitoring to detect and respond to potential threats.
Zscaler has enhanced its security measures to cover this threat, ensuring that any attempts to download a malicious npm package will be detected under the following threat classifications:
Advanced Threat Protection
Attempts to access the web service for data exfiltration will be identified and flagged under the following threat name:
Advanced Threat Protection
Thank you for reading
Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.
Supply Chain Risk in Python: Termncolor and Colorinal Explained
Malicious PyPI Packages Deliver SilentSync RAT
NodeLoader Exposed: The Node.js Malware Evading Detection
By submitting the form, you are agreeing to our privacy policy.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。