Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories
A second wave of the Shai-Hulud worm, uploaded to npm between November 21 and 23, 2025 and detected on November 24, ran a preinstall payload that harvested credentials from local files, environment variables, cloud metadata services and cloud secret managers. It published the stolen data to GitHub repositories, registered infected machines as self-hosted runners, and used stolen npm tokens to trojanize more packages.
- Victim
- Multiple: npm maintainers and users, including Zapier, ENS Domains, PostHog and Postman packages
- Industry
- Technology
- Country
- Global
- Intrusion began
- Nov 21, 2025
- First disclosed
- Nov 24, 2025
- Actor
- Unattributed
- Initial access
- Supply chain
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Developer and CI credentials were readable at install time and worked from anywhere. Short-lived, workload-bound credentials and blocking install scripts by default remove most of what the worm feeds on.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- Sha1-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposed, Wiz, Nov 24, 2025
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26), Unit 42, Palo Alto Networks, Nov 26, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Shai-Hulud self-replicating npm worm steals maintainer tokens 2025 · Supply chain
- tj-actions/changed-files GitHub Action compromise leaks CI secrets 2025 · Supply chain
- Nx s1ngularity npm compromise harvests developer secrets with AI CLIs 2025 · Supply chain
- Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor 2021 · Supply chain
Cite this record
SWI Community Team. (2026). Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-shai-hulud-2-npm-worm/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.