Back Aikido.Dev

Shai Hulud strikes again, hitting Zapier, Ensdomains

Aikido.Dev • November 24, 2025

It's another Monday morning, sitting down at the computer. And I see a stack of alerts from the last hour of packages showing signs of malware in our triage queue. Having not yet finished my first cup of coffee, I see Shai Hulud indicators. Yikes, surely that's a false positive? Nope, welcome to Monday, Shai Hulud struck agan. Strap in.

We've detected the following packages compromised with a new version of Shai Hulud:

This time, the malware also publishes secrets to GitHub, with a random name and the repository description:

"Sha1-Hulud: The Second Coming."

Currently we see 16k repositories exposed:

Story developing... Stay tuned for updates.

Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shai-Hulud Malware Infects npm Packages, Compromising Thousands of Repositories A new wave of the Shai-Hulud malware has compromised nearly 500 npm packages, affecting over 26,000 GitHub repositories. This self-replicating worm, which targets developers' credentials and secrets, has been linked to a significant supply chain attack that began in late November 2025. The malware has evolved from its initial version, employing improved tactics for propagation and data exfiltration. 43 sources 28

Extracted Entities

Shai Hulud strikes again, hitting Zapier, Ensdomains

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Malware (1)

Platforms (1)