Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

Databreaches •Dissent • November 24, 2025

Bill Toulas reports: Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in the npm registry in a new Shai-Hulud supply-chain campaign. The malicious packages have been added to NPM (Node Package Manager) over the weekend to steal developer and continuous integration and continuous delivery (CI/CD) secrets.... Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shai-Hulud Malware Infects npm Packages, Compromising Thousands of Repositories A new wave of the Shai-Hulud malware has compromised nearly 500 npm packages, affecting over 26,000 GitHub repositories. This self-replicating worm, which targets developers' credentials and secrets, has been linked to a significant supply chain attack that began in late November 2025. The malware has evolved from its initial version, employing improved tactics for propagation and data exfiltration. 43 sources 28

Extracted Entities

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (1)

Tools (1)