NPM · SEPTEMBER 2025 · CONFIRMED

Shai-Hulud npm Worm: What Happened and Who Was Affected

In September 2025, a wave of compromises hit widely used npm packages. A phishing attack against maintainer accounts pushed trojanized versions of packages like chalk and debug to the registry, and a separate, self-propagating worm publicly dubbed “Shai-Hulud” spread through the @ctrl/tinycolor package and beyond, stealing GitHub and cloud credentials from every machine it infected and using them to compromise the next maintainer’s packages in turn. Estimates of the total number of affected packages grew from an initial handful to the hundreds as the campaign was tracked in the following weeks.

What happened

On September 8, 2025, npm maintainer Josh Junon (known as Qix-) was compromised via a phishing attack targeting his account credentials. Attackers used the access to publish malicious versions of several widely used packages, including chalk, debug, strip-ansi, ansi-regex, color-convert, and wrap-ansi. Combined, the affected packages had roughly two billion historical downloads, though the compromised versions themselves were downloaded a much smaller number of times before being caught and pulled.

Around the same period, a distinct but related campaign began spreading through @ctrl/tinycolor, a popular color-manipulation package. This payload, publicly nicknamed Shai-Hulud after the sandworms in Dune, was self-propagating: once it compromised a machine, it scanned for GitHub Personal Access Tokens and cloud credentials (AWS, GCP, Azure), then used any it found to publish trojanized versions of that maintainer’s own packages, spreading the worm further. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on the widespread compromise on September 23, 2025. Tracking by security researchers found the confirmed package count climbing from an initial cluster into the hundreds as the campaign was investigated over subsequent weeks.

Packages affected

Because the worm actively spread by publishing new malicious versions, the full list changed as the campaign was tracked. Socket and other security research firms maintained running lists during the incident; check your own dependency tree against your package manager’s lockfile history for the affected date range if you have reason to believe you installed during the window.

How 0Day mitigates this

EARLY WARNING, NOT AFTER THE FACT0Day is built to flag exactly this pattern: a package your organization depends on getting flagged by a threat intelligence source, corroborated, and pushed to the engineers who own the affected repositories, often before an official advisory or CVE exists. In an incident like this one, that means the gap between the first trojanized version landing on the registry and your team knowing about it collapses from days to minutes.

See the full three-stage pipeline 0Day uses to corroborate a signal before alerting, or read how this differs from waiting on a dependency scanner to catch a known advisory.

Sources

CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem
Trend Micro: What We Know About the NPM Supply Chain Attack
Truesec: 500+ npm Packages Compromised in Ongoing Supply Chain Attack “Shai-Hulud”
StepSecurity: 20+ Popular NPM Packages Compromised

Join the 0Day waitlist →

← Back to all incidents