ShadowPad Attack Exploits WSUS Vulnerability Affecting 25K+ npm Repos

First seen 7 Dec 2025, 20:47 UTC • Securityaffairs.Co

•29

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The ShadowPad malware attack has exploited a remote code execution vulnerability (CVE-2025-59287) in Windows Server Update Services (WSUS). This incident has exposed over 25,000 npm repositories, allowing cyber threat actors to target users of messaging applications. Morphisec has reported that the attack is linked to Russian cyber operations.

How this analysis works

Attack Flow

Continue Reading

Checkmarx Jenkins Plugin Compromised by TeamPCP Malware Attack Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages Shai Hulud npm Worm Compromises Over 26,000 Repositories OpenAI Faces Supply Chain Attack via TanStack npm Library Shai-Hulud 2.0 Malware Worm Targets Node Package Ecosystem Shai-Hulud 2.0 Supply Chain Attack Targets Cloud Ecosystems

ShadowPad Attack Exploits WSUS Vulnerability Affecting 25K+ npm Repos

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading