Shai Hulud Worm Resurfaces in npm, Infects 700+ Packages

A sophisticated self-propagating worm known as Shai Hulud has resurfaced in the npm package registry, compromising hundreds of widely used software libraries and exposing sensitive credentials across thousands of GitHub repositories. The attack, detected in late November 2025, builds on an earlier campaign from September and has already infected more than 700 packages, affecting developers and organizations worldwide.

Security researchers identified the new variant, sometimes referred to as Shai Hulud 2.0 or SHA1Hulud, beginning around November 21. It spreads through trojanized versions of legitimate npm packages, which include hidden preinstall scripts that execute automatically upon installation. Once activated on a developer's machine or continuous integration and continuous delivery (CI/CD) system, the malware scans for credentials such as npm tokens, GitHub personal access tokens, and cloud keys from providers like AWS, Azure, and Google Cloud Platform. It then uses these stolen secrets to publish malicious updates to other packages maintained by the victim, creating a rapid chain of infections.

The worm employs legitimate tools like TruffleHog, originally designed for...