Shai-Hulud npm worm spread through hundreds of package versions and stole credentials

A worm used credentials to republish itself

Shai-Hulud appeared in npm in September 2025. ReversingLabs identifies the earliest known malicious release as rxnt-authentication 0.0.3, published September 14 at 17:58:50 UTC; it says the activity was first detected on September 15. A contemporaneous Semgrep advisory reported more than 187 affected package names.

The post-install payload searched developer environments for credentials, including npm and GitHub tokens and cloud keys. When it found valid npm publishing credentials, it could publish malicious versions of other packages maintained by the victim, extending the outbreak. Researchers also reported exfiltration to attacker-controlled GitHub repositories and webhooks.

Package names and releases are different counts

Socket’s September 16 tracker listed 526 package-version records and described the total as nearly 500 packages. A package can have several compromised versions, so that inventory does not mean 526 distinct package names. Semgrep’s early count of 187+ refers to affected package names at that point in the response.

• Treat npm install scripts as executable code and limit where they run, especially in CI
• Use short-lived, narrowly scoped publishing tokens and trusted publishing where available
• If a compromised release ran, audit package publishing and repository activity, then rotate exposed secrets