Widespread Supply Chain Compromise Impacting npm Ecosystem [View all]
Source: Cyber Security & Infrastructure Security Agency
Release DateSeptember 23, 2025
CISA is releasing this Alert to provide guidance in response to a widespread software supply chain compromise involving the world’s largest JavaScript registry, npmjs.com. A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages.
After gaining initial access, the malicious cyber actor deployed malware that scanned the environment for sensitive credentials. The cyber actor then targeted GitHub Personal Access Tokens (PATs) and application programming interface (API) keys for cloud services, including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[ii]
The malware then:
Exfiltrated the harvested credentials to an endpoint controlled by the actor.
Uploaded the credentials to a public repository named Shai-Hulud via the GitHub/user/repos API.
Leveraged an automated process to rapidly spread by authenticating to the npm registry as the compromised developer, injecting code into other packages, and publishing compromised versions to the registry.[iii]
Read more: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
If this is the wrong forum I apologize but getting the message out quickly is important.
= new reply since forum marked as read