DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 15 Sept 2025197 packages · 509 versions

Original Shai-Hulud npm worm

Summary

First successful self-propagating worm in the npm ecosystem. Downstream of the August 2025 s1ngularity/Nx GitHub-token theft. The postinstall hook ran TruffleHog to harvest secrets, opened public GitHub repos named "Shai-Hulud" to publish them, force-converted private repos to public with a "-migration" suffix, and used stolen npm tokens to publish malicious versions of any package the maintainer could access. ~180 unique packages compromised across 300+ versions, including CrowdStrike's own scope (@crowdstrike/*).

worminfostealercredential-theftaccount-takeovermaintainer-takeover
Detected by
StepSecurity · Socket · Aikido · Wiz
Also known as
Shai-Hulud · s1ngularity downstream
Ecosystems
npm
Packages tracked
197

What happened

Shai-Hulud is the first publicly-confirmed self-propagating worm in the npm ecosystem. It descends directly from the August 2025 s1ngularity / Nx GitHub-token theft: a researcher leaked Personal Access Tokens from contributors to the nrwl/nx repo, and those tokens were used a month later to seed the worm into reachable maintainer accounts.

The payload runs from a postinstall hook. It uses TruffleHog to scan the host for any credentials it can find - npm tokens, GitHub PATs, AWS/GCP/Azure keys, anything matching a known secret pattern - then performs three propagation moves: it creates a public GitHub repo named "Shai-Hulud" containing the stolen secrets, force-converts private repos belonging to the victim to public with a -migration suffix, and uses the stolen npm tokens to push new malicious versions of every package the maintainer can publish to.

Around 180 unique packages were compromised across 300+ versions before npm and GitHub coordinated takedowns. High-blast-radius hits included @ctrl/tinycolor, ngx-bootstrap, ngx-toastr, and - notably - the entire @crowdstrike/* scope, which forced an internal incident response at CrowdStrike. The worm continued to surface in mini-revivals through early 2026 (see multi-2026-04-30-mini-shai-hulud-wave2 and npm-2026-05-shai-hulud-tanstack).

If you built anything against an affected package between September 15 and 18, 2025, treat the host as credential-compromised: rotate every secret reachable from that environment, then audit the GitHub org for unexpected public repos and -migration twins.

Affected packages (197)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • TruffleHog-driven secret discovery on dev/CI machines
  • Public exposure of private repositories ("-migration" rename pattern)
  • Stolen-credential propagation to any reachable npm package
  • Malicious GitHub Actions workflows for repository-secret exfil
  • High-blast-radius packages hit: @ctrl/tinycolor, ngx-bootstrap, ngx-toastr, @crowdstrike/*

What to do

  1. 1Rotate npm + GitHub tokens used in any environment that resolved affected versions
  2. 2Audit your GitHub org for public repos created under your account or with "Shai-Hulud" in the name
  3. 3Review private repos for unexpected "-migration" public twins
  4. 4Investigate any unexpected publish activity on packages you own
  5. 5For projects using @crowdstrike/* scopes, treat any host that built after 15 Sept 2025 as suspect until verified

References

Back to feedSubmit a correction
npm-2025-09-shai-hulud-original