Shai Hulud malware hits NPM as crypto libraries face a growing security crisis

A new round of NPM infections has triggered concern across the JavaScript community as the Shai Hulud malware continues to move through hundreds of software libraries.

Aikido Security has confirmed that more than 400 NPM packages have been compromised, including at least 10 widely used across the crypto ecosystem.

The scale of the issue places developers under immediate pressure to assess the risk, especially those working with blockchain tools and applications.

The disclosure came on Monday when Aikido Security released a detailed list of contaminated libraries following a review of unusual behaviour on NPM.

A separate post from researcher Charles Eriksen also highlighted the infection list on X, drawing attention to key ENS packages involved in the incident.

The infections appear to be tied to an active supply chain attack that has been unfolding in recent weeks, adding momentum to a pattern of escalating security incidents within JavaScript infrastructure.

The surge in infections follows a major NPM breach in early September. That earlier case ended with attackers stealing 50 million dollars worth of crypto, making it one of the largest supply chain incidents linked directly to digital asset theft.

According to Amazon Web Services , the attack was followed within a week by the appearance of Shai Hulud, which began spreading autonomously across projects.

While the initial September incident targeted crypto assets directly, Shai Hulud operates differently. It focuses on collecting credentials from any environment that downloads an infected package. If wallet keys happen to be present, they are treated like any other secret and extracted.

This shift in behaviour makes the new incident broader in scope.

Instead of aiming at a single objective, the malware integrates itself into developer workflows and moves through dependency chains, increasing the chance of accidental exposure across both crypto and non-crypto projects.

The crypto packages affected in the latest review show a clear concentration around the Ethereum Name Service ecosystem. Several ENS-related libraries, many with tens of thousands of weekly downloads, appear on the compromised list.

These include content-hash, address-encoder, ensjs, ens-validation, ethereum-ens, and ens-contracts.

To support the findings, Eriksen shared a detailed X post outlining the compromised ENS packages. Shortly after, a second X update from Eriksen expanded on the wider spread of infections affecting additional repositories.

Each ENS package supports functions used across wallet interfaces, blockchain applications, and tools that convert human-readable names into machine-readable formats.

Their popularity means that the impact may stretch beyond direct maintainers to downstream developers who rely on them for core operations.

A separate crypto library, crypto-addr-codec, was also identified among the compromised packages. Though unrelated to ENS, it is used in wallet-related processes and carries high weekly traffic, making its contamination another priority area for security reviews.

The spread is not limited to digital asset tools. Several non-crypto libraries have also been impacted, including packages associated with the workflow automation platform Zapier .

Some of these report weekly downloads well above forty thousand, indicating the malware has reached parts of the JavaScript ecosystem unrelated to blockchain activity.

Additional libraries highlighted in later posts show even higher levels of distribution. One package appeared close to seventy thousand weekly downloads.

Another recorded weekly traffic above one and a half million, reflecting a much wider footprint than early reports suggested.

The rapid expansion has drawn attention from other security teams. Researchers at Wiz stated that they had identified more than twenty-five thousand affected repositories linked to around three hundred and fifty users.

They also noted that one thousand new repositories were being added every thirty minutes in the early stages of the investigation.

This level of growth demonstrates how quickly supply chain contamination can accelerate when packages replicate across dependency networks.

Developers working with NPM have been advised to perform immediate checks, validating environments and scanning for possible exposure.

With dependency chains being interlinked across multiple industries, even teams outside the crypto sector could unknowingly integrate infected packages.

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

Dogecoin News Today: Dogecoin's Unsteady Rebound Depends on Holding $0.15 Support as Derivatives Show Conflicting Signals

- Dogecoin (DOGE) drops 37% to $0.1587 amid crypto market weakness and Fed policy uncertainty. - Technical indicators show bearish control with RSI at 34 and MACD in negative crossover. - Derivatives markets show mixed signals: $1.66B open interest but declining MFI indicates outflows. - Grayscale's GDOG ETF fails to reverse selling pressure as $0.1500 support becomes critical for recovery.

Shiba Inu's Safeguard Against AlphaPepe's Risk: A Showdown of Meme-Coin Tactics

- Shiba Inu (SHIB) faces critical support tests amid crypto market declines, while AlphaPepe (ALPE) emerges as a high-growth meme-coin presale contender. - SHIB trades near $0.0000080 with 20,000% burn spikes, but remains 90% below all-time highs despite stabilization hopes. - AlphaPepe's $415K-raised BNB Chain token offers structured mechanics, liquidity locks, and "buy early, pay less" dynamics to differentiate from traditional meme-coins. - Analysts highlight strategic duality: SHIB's long-term case dep

Trademark Dispute: OpenAI's 'Cameo' Restriction Sheds Light on Legal Challenges in AI

- U.S. Judge Eumi K. Lee temporarily banned OpenAI from using "Cameo" in its Sora app until December 22, citing trademark infringement by Chicago-based Cameo. - Cameo argued the term caused consumer confusion, with users contacting them Sora's feature, highlighting brand overlap since 2017. - OpenAI contested the ruling, claiming "cameo" is generic, mirroring its legal strategy in India and facing broader IP lawsuits from authors and publishers. - The case underscores AI companies' legal risks, with

Fed Officials Divided on Rate Cut Despite Pressure from Trump

- The Fed faces internal division over December rate cuts, complicating Trump's push for lower borrowing costs amid conflicting economic signals. - New York Fed's Williams supports near-term rate adjustments, while Boston's Collins dismisses urgency, reflecting broader policy disagreements. - Trump's potential influence is limited by Fed dissent, with delayed inflation data and mixed labor market trends adding to decision-making uncertainty. - Global markets and geopolitical developments will shape investo