Back Hackread

Shai Hulud npm Worm Impacts 26,000+ Repos in Supply Chain Attack

Hackread •Deeba Ahmed • November 24, 2025

The Shai Hulud worm's "Second Coming" has compromised over 26,000 public repositories. We detail the attacker's mistake, the target packages, and mandatory security tips.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shai-Hulud Malware Infects npm Packages, Compromising Thousands of Repositories A new wave of the Shai-Hulud malware has compromised nearly 500 npm packages, affecting over 26,000 GitHub repositories. This self-replicating worm, which targets developers' credentials and secrets, has been linked to a significant supply chain attack that began in late November 2025. The malware has evolved from its initial version, employing improved tactics for propagation and data exfiltration. 43 sources 28

Extracted Entities

Shai Hulud npm Worm Impacts 26,000+ Repos in Supply Chain Attack

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Tools (1)