Massive NPM Supply Chain Attack: “Shai-Hulud: The Second Coming” Infects Popular Packages

Massive NPM Supply Chain Attack: “Shai-Hulud: The Second Coming” Infects Popular Packages

A critical npm malware attack is currently sweeping through the developer ecosystem. Named “Shai-Hulud: The Second Coming” after the iconic sandworms from Dune, this worm has already compromised hundreds of widely-used npm packages, affecting thousands of developers globally. The attack took place between November 21–24, 2025, targeting major packages like Zapier, Postman, PostHog, ENS Domains, and AsyncAPI.

How the Malware Works

The attackers gained access to the accounts of legitimate package maintainers and uploaded infected versions of the original packages. Once a developer runs npm install, the malicious code executes automatically — even before the installation completes or the user notices any suspicious activity.

The worm’s primary goal is to steal sensitive credentials. It scans the infected system for:

• API keys
• GitHub tokens
• npm credentials
• AWS and Azure keys
• SSH keys

All stolen information is then uploaded to public GitHub repositories labeled “Sha1-Hulud: The Second Coming.”

Additionally, the malware installs a persistent backdoor, allowing attackers to execute commands remotely at any time. In worst-case scenarios, if the malware cannot exfiltrate data, it wipes the user’s entire home directory.

Impact on the Developer Ecosystem

• Over 700 npm packages infected
• More than 25,000 GitHub repositories contain stolen credentials
• Around 132 million monthly downloads affected
• New compromised secrets appear approximately every 30 minutes

Full List of Affected Packages

Developers should immediately check if they use any of the following infected packages:

AsyncAPI Packages:
@asyncapi/diff, @asyncapi/nodejs-ws-template, go-template, @asyncapi/avro-schema-parser, @asyncapi/converter, @asyncapi/dotnet-rabbitmq-template, @asyncapi/nunjucks-filters, @asyncapi/protobuf-schema-parser, @asyncapi/problem, @asyncapi/optimizer, @asyncapi/python-paho-template, @asyncapi/multi-parser, @asyncapi/bundler, @asyncapi/php-template, asyncapi-preview, @asyncapi/java-spring-cloud-stream-template, @asyncapi/modelina-cli, @asyncapi/generator-helpers, @asyncapi/java-template, @asyncapi/react-component, @asyncapi/generator, @asyncapi/server-api, @asyncapi/java-spring-template, @asyncapi/cli, @asyncapi/web-component, @asyncapi/specs, @asyncapi/modelina, @asyncapi/parser, @asyncapi/html-template, @asyncapi/go-watermill-template, @asyncapi/openapi-schema-parser, @asyncapi/edavisualiser, @asyncapi/generator-components, dotnet-template, @asyncapi/keeper, github-action-for-generator, @asyncapi/nodejs-template, @asyncapi/markdown-template, @quick-start-soft/quick-git-clean-markdown, @quick-start-soft/quick-markdown-image, @quick-start-soft/quick-markdown-translator, @quick-start-soft/quick-markdown, test23112222-api, @asyncapi/generator-react-sdk, @quick-start-soft/quick-markdown-compose, iron-shield-miniapp, manual-billing-system-miniapp-api, shinhan-limit-scrap, @strapbuild/react-native-perspective-image-cropper, react-native-use-modal, @quick-start-soft/quick-task-refine, @strapbuild/react-native-date-time-picker, @strapbuild/react-native-perspective-image-cropper-2, create-glee-app, @strapbuild/react-native-perspective-image-cropper-poojan31, @asyncapi/studio, @quick-start-soft/quick-markdown-print, @quick-start-soft/quick-remove-image-background

PostHog Packages:
posthog-node, @posthog/first-time-event-tracker, @posthog/event-sequence-timer-plugin, @posthog/gitub-star-sync-plugin, posthog-plugin-hello-world, @posthog/bitbucket-release-tracker, @posthog/maxmind-plugin, @posthog/postgres-plugin, @posthog/twilio-plugin, @posthog/cli, @posthog/clickhouse, @posthog/snowflake-export-plugin, posthog-react-native-session-replay, @posthog/drop-events-on-property-plugin, @posthog/github-release-tracking-plugin, @posthog/icons, @posthog/geoip-plugin, @posthog/intercom-plugin, @posthog/plugin-unduplicates, @posthog/react-rrweb-player, drop-events-on-property-plugin, @posthog/ingestion-alert-plugin, @posthog/kinesis-plugin, @posthog/laudspeaker-plugin, @posthog/nextjs, @posthog/nextjs-config, @posthog/automatic-cohorts-plugin, @posthog/migrator3000-plugin, @posthog/pagerduty-plugin, @posthog/plugin-contrib, @posthog/sendgrid-plugin, @posthog/customerio-plugin, @posthog/rrweb-utils, @posthog/taxonomy-plugin, @posthog/zendesk-plugin, @posthog/netdata-event-processing, @posthog/url-normalizer-plugin, posthog-docusaurus, @posthog/currency-normalization-plugin, @posthog/filter-out-plugin, @posthog/heartbeat-plugin, @posthog/ai, @posthog/databricks-plugin, @posthog/core, @posthog/lemon-ui, posthog-react-native, @posthog/agent, @posthog/variance-plugin, @posthog/rrweb-replay, @posthog/rrweb-snapshot, @posthog/plugin-server, @posthog/rrweb-record, @posthog/rrweb, posthog-js, @posthog/web-dev-server, @posthog/piscina, @posthog/nuxt, @posthog/rrweb-player, @posthog/wizard, @posthog/siphash, @posthog/twitter-followers-plugin, @posthog/rrdom, @posthog/hedgehog-mode

Postman Packages:
@postman/secret-scanner-wasm, @postman/csv-parse, @postman/node-keytar, @postman/tunnel-agent, @postman/pm-bin-macos-arm64, @postman/pm-bin-linux-x64, @postman/postman-collection-fork, @postman/postman-mcp-server, @postman/wdio-junit-reporter, @postman/aether-icons, @postman/postman-mcp-cli, @postman/pretty-ms, @postman/pm-bin-windows-x64, @postman/wdio-allure-reporter, @postman/final-node-keytar, @postman/pm-bin-macos-x64, @postman/mcp-ui-client

Zapier Packages:
@zapier/babel-preset-zapier, @zapier/browserslist-config-zapier, @zapier/zapier-sdk, @zapier/stubtree, zapier-async-storage, @zapier/ai-actions, @zapier/mcp-integration, @zapier/spectral-api-ruleset, zapier-scripts, @zapier/secret-scrubber, @zapier/ai-actions-react, @zapier/eslint-plugin-zapier, zapier-platform-legacy-scripting-runner, zapier-platform-schema, zapier-platform-core, zapier-platform-cli

ENS Domains Packages:
@ensdomains/vite-plugin-i18next-loader, @ensdomains/blacklist, @ensdomains/durin, @ensdomains/renewal, @ensdomains/cypress-metamask, @ensdomains/dnsprovejs, @ensdomains/ccip-read-dns-gateway, @ensdomains/ccip-read-cf-worker, @ensdomains/dnssec-oracle-anchors, @ensdomains/reverse-records, @ensdomains/ens-test-env, @ensdomains/hackathon-registrar, @ensdomains/renewal-widget, crypto-addr-codec, @ensdomains/solsha1, @ensdomains/server-analytics, @ensdomains/ui, @ensdomains/test-utils, @ensdomains/mock, @ensdomains/ccip-read-router, @ensdomains/address-encoder, @ensdomains/eth-ens-namehash, @ensdomains/buffer, @ensdomains/thorin, @ensdomains/op-resolver-contracts, @ensdomains/ens-archived-contracts, @ensdomains/ensjs, @ensdomains/subdomain-registrar, @ensdomains/unruggable-gateways, @ensdomains/web3modal, @ensdomains/ens-contracts, @ensdomains/react-ens-address, @ensdomains/curvearithmetics, @ensdomains/hardhat-toolbox-viem-extended, ethereum-ens, @ensdomains/durin-middleware, @ensdomains/unicode-confusables, @ensdomains/ensjs-react, @ensdomains/content-hash, @ensdomains/ens-avatar, @ensdomains/offchain-resolver-contracts, @ensdomains/ens-validation, @ensdomains/name-wrapper

Other Major Packages:
@quick-start-soft/*, @actbase/*, @seung-ju/*, @strapbuild/*, @voiceflow/*, @kvytech/*, @trigo/*, @postman/*, @dev-blinq/*, @lessondesk/*, @varsityvibe/*, @alexcolls/*, @accordproject/*, @clausehq/*, @fishingbooker/*, @hover-design/*, @tiaanduplessis/*

Note: This is a high-level summary. Developers should check their package.json for any of these packages, especially versions installed between November 21–24, 2025.

Quick command to check:

cat package.json | grep -E "zapier|postman|posthog|ensdomains|asyncapi"

Immediate Steps for Developers

If you installed any of the affected packages between November 21–24, 2025, follow these precautions:

1. Assume all credentials are compromised. Immediately rotate GitHub tokens, npm tokens, AWS keys, Azure keys, and any other secrets stored on that machine.
2. Search GitHub for repositories containing the string “Sha1-Hulud: The Second Coming”. Your secrets may have been exposed.
3. Inspect .github/workflows/ for unknown or suspicious files.
4. Use package versions released before November 21, 2025 to prevent re-infection.

This incident highlights the dangers of supply chain attacks. Developers trust package managers like npm to deliver legitimate code, but attackers exploit that very trust, compromising millions of downloads without users realizing it.

Why This Matters

Supply chain attacks like Shai-Hulud demonstrate how attackers target developer tools rather than individual machines. Understanding these threats is crucial for security-conscious developers and organizations.

Those interested in defending against such attacks can benefit from ethical hacking courses, which cover reconnaissance, OSINT techniques, and security fundamentals. Knowing how attackers operate is the first step in preventing catastrophic breaches.

FAQs

Protect Your Developer Environment Now

Don’t risk your credentials and sensitive data. Check your npm packages, rotate compromised tokens, and secure your GitHub and cloud accounts immediately.