Shai-Hulud: The Self-Replicating Worm Targeting NPM Supply Chains

A new, highly sophisticated, and self-replicating worm named “Shai-Hulud” (VulnDB ID: 419253) has emerged as a significant threat to the open-source software supply chain. At time of publication, Shai-Hulud does not have a CVE ID. Flashpoint’s intelligence team has identified that this malicious worm has already compromised over 187 software packages in the JavaScript repository NPM (Node Package Manager), a number that is likely to grow.

This post will break down what the worm is, how it works, and the critical steps you can take to protect your projects and organization.

What is the Shai-Hulud Worm?

The Shai-Hulud worm is a multi-stage malware designed to execute automatically upon the installation of a compromised NPM package. It targets developers on Linux and macOS systems, and its primary objective is to steal a wide range of sensitive credentials, such as GitHub access tokens and SSH keys. However it is important to note that this vulnerability is different from “Multiple Packages for Node.js index.js Malicious Code Crypto Currency Transaction Manipulation,” an earlier NPM attack (VulnDB ID: 418033) that was disclosed on September 8, 2025.

Flashpoint analysts assess that this attack is a direct and more dangerous evolution of a previously observed threat actor campaign known as “s1ngularity”.

What Was the s1ngularity Attack?

S1ngularity was an earlier attack that also targeted the NPM ecosystem, compromising versions of the popular Nx build system. Like Shai-Hulud, its goal was to steal developer credentials and expose private repositories. The key difference, however, was in its spread.

The s1ngularity attackers had to manually use a stolen NPM token to publish malicious packages. Shai-Hulud, by contrast, is a true worm; it automates the propagation process, using stolen credentials to identify and infect new packages on its own, creating a cascading and rapid infection chain.

How Shai-Hulud Works

The worm’s self-propagation mechanism is its most dangerous feature. It spreads through a malicious “postinstall” script embedded in the package.json file of infected packages. Once a developer installs a compromised package, the script executes, and the worm begins working towards its malicious objectives.

Shai-Hulud’s core mission is to harvest as many developer credentials and secrets as possible. It meticulously scans the infected system and CI/CD environments for valuable data, including:

• NPM and GitHub authentication tokens
• SSH keys
• Cloud credentials for platforms like Azure
• Cryptocurrency wallets

Shai-Hulud then uses stolen NPM authentication tokens to identify and infect other packages maintained by the compromised developer, which in turn compromises any commercial software relying on them. The worm targets a maintainer’s top 20 most popular packages, injecting its malicious script and republishing them to the NPM registry. 

This automated, self-replicating process is what allows Shai-Hulud to spread at an unprecedented rate without any further attacker intervention.

Why This Matters: The Role of OSS and NPM Packages

The foundation of modern software development relies on open-source software (OSS) and libraries. OSS serves as a force multiplier for developers, allowing them to leverage pre-built applications for common software functionality, instead of dedicating resources to build them from scratch. As such, it is common for a given commercial software to be composed of hundreds of OSS or third-party libraries.

At the heart of the open-source JavaScript ecosystem is NPM. Not just a tool, NPM is a massive public registry that serves as the central hub for reusable code packages making it a high-value target for attackers. This system’s importance cannot be overstated:

• Efficiency: NPM packages allow developers to integrate complex functionality with a single command, saving thousands of hours of work.
• Interconnectivity: Modern applications are not monolithic; they are built from a web of interconnected NPM packages, with a single project often relying on hundreds or even thousands of dependencies.
• Ubiquity: From the smallest front-end websites to the largest enterprise backends, NPM packages are the critical components that power a vast portion of the modern internet.

Protecting Your Projects Against Shai-Hulud

Immediate action is critical to protect your projects from Shai-Hulud and similar attacks. Flashpoint recommends the following guidance to mitigate your risk:

1. Check your systems: Scan your systems and projects for any of the 187+ compromised NPM packages identified by Flashpoint. Additionally, be cautious about future packages being added to your projects.
2. Use a SBOM (Software Bill of Materials): A SBOM provides an essential inventory of every package in your software, acting as a crucial map for your dependencies. Combine it with a threat intelligence feed to instantly identify and respond to compromised packages once they become known.
3. Rotate keys: Immediately rotate all developer keys and credentials, including NPM tokens, GitHub personal access tokens, and cloud credentials.
4. Enable 2FA/MFA: Enforce two-factor or multi-factor authentication on all developer accounts, particularly for NPM and GitHub.
5. Use a Package Lock File: Use a package-lock.json, yarn.lock, or pnpm-lock.yaml file to pin your dependencies to specific, trusted versions. This prevents the automatic installation of a newly published, potentially malicious version.
6. Clean your NPM cache: Clear local NPM cache to ensure no compromised packages are being stored on your system. Run the command “npm cache clean –force”.

Safeguard OSS Using Flashpoint

Open-source vulnerabilities have profoundly reshaped the vulnerability intelligence landscape, with seismic events like Log4Shell and Heartbleed serving as stark reminders of the risks hidden deep within the software supply chain. The Shai-Hulud worm represents a powerful new escalation in this threat, demonstrating its ability to automatically replicate and spread through trusted maintainer accounts. 

To learn how Flashpoint’s vulnerability intelligence, enriched with comprehensive threat intelligence and expert insights can help your organization proactively defend against Shai-Hulud and other supply chain attacks, request a demo today.