Widespread Supply Chain Compromise Impacting npm Ecosystem

This section contains time sensitive announcements about specific cyber threats, vulnerabilities and scams. Each alert has information you need to be aware of, and what actions to take to mitigate any risk to you or your organisation.

Subscribe to our updates to be notified as soon as we publish an alert.

10:30am, 29 September 2025

TLP Rating: Clear

Widespread Supply Chain Compromise Impacting npm Ecosystem

After gaining initial access, the malicious cyber actor is deploying a payload that functions as a worm.

The malware reportedly scans the environment for sensitive credentials, including GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

The malware then:

  • Exfiltrates the harvested credentials to an endpoint controlled by the actor.
  • Uploads the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
  • Leverages an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.

What's happening

Systems affected

Javascript npm packages.

What this means

Malicious actors are using malware to compromise Java Scipt npm packages.

What to look for

How to tell if you're at risk

Look to identify potentially malicious npm packages with the advice below.

What to do

Mitigation

The following suggestions can be implemented to help identify and mitigate the issue:

  • Conduct a dependency review of all software leveraging the npm package ecosystem.
    • Check for package-lock.json or yarn.lock files to identify affected packages, including those nested in dependency trees.
  • Search for cached versions of affected dependencies in artifact repositories and dependency management tools.
  • Pin npm package dependency versions to known safe releases produced prior to Sept. 16, 2025.
  • Immediately rotate all developer credentials.
  • Mandate phishing-resistant multifactor authentication (MFA) on all developer accounts, especially for critical platforms like GitHub and npm.
  • Monitor for anomalous network behaviour.
    • Block outbound connections to webhook.site domains.
    • Monitor firewall logs for connections to suspicious domains.
  • Harden GitHub security by removing unnecessary GitHub Apps and OAuth applications, and auditing repository webhooks and secrets.
  • Enable branch protection rules, GitHub Secret Scanning alerts, and Dependabot security updates.

More information