Shai-Hulud self-replicating npm worm steals maintainer tokens
In mid-September 2025 a self-replicating worm dubbed Shai-Hulud spread through npm by stealing developer credentials from infected machines, including npm tokens, GitHub personal access tokens and cloud API keys, and using the stolen npm tokens to publish trojanized versions of the victims' other packages. CISA warned on September 23, 2025 that more than 500 packages had been compromised and urged credential rotation and phishing-resistant MFA on developer accounts.
- Victim
- Multiple: npm package maintainers and downstream users
- Industry
- Technology
- Country
- Global
- Intrusion began
- Sep 2025
- First disclosed
- Sep 15, 2025
- Actor
- Unattributed
- Initial access
- Supply chain
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Each stolen publish token let the worm infect a new maintainer with no human in the loop. Phishing-resistant MFA on registry accounts, short-lived publishing credentials and rotation after any exposure stop the propagation.
Go deeper on SWI
- Technique: Secrets in repositories and CI
Sources
- Widespread Supply Chain Compromise Impacting npm Ecosystem, CISA, Sep 23, 2025
- "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack, Unit 42, Palo Alto Networks, Nov 26, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Shai-Hulud 2.0 npm worm exposes credentials in 25,000+ repositories 2025 · Supply chain
- tj-actions/changed-files GitHub Action compromise leaks CI secrets 2025 · Supply chain
- Nx s1ngularity npm compromise harvests developer secrets with AI CLIs 2025 · Supply chain
- Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor 2021 · Supply chain
Cite this record
SWI Community Team. (2026). Shai-Hulud self-replicating npm worm steals maintainer tokens. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-shai-hulud-npm-worm/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.