---
title: Self-Replicating Malware Hits 180+ NPM Packages in Massive Supply Chain Attack
description: "\"Shai-Hulud worm hits over 180 NPM packages, compromising accounts and spreading secrets via GitHub. One of the worst JavaScript attacks ever.\""
canonical_url: https://codekeeper.co/ticker/shai-hulud-worm-npm-attack
---

# Self-Replicating Malware Hits 180+ NPM Packages in Massive Supply Chain Attack

"Shai-Hulud worm hits over 180 NPM packages, compromising accounts and spreading secrets via GitHub. One of the worst JavaScript attacks ever."

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 18, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A devastating supply chain attack called Shai-Hulud infected over 180 NPM packages starting September 14, compromising 40+ developer accounts and publishing 700+ malicious versions. The self-replicating worm steals secrets, dumps them on public GitHub repositories, and spreads by hijacking NPM tokens to infect more packages. High-profile targets included @ctrl/tinycolor (2 million weekly downloads) and CrowdStrike packages. The malware harvests GitHub, AWS, and Google Cloud credentials, then creates public repos labeled 'Shai-Hulud Migration' to expose stolen secrets. Security firms call it one of the most severe JavaScript supply-chain attacks ever. The worm targets Linux and macOS systems while skipping Windows machines. Though many credentials were quickly revoked, dozens of GitHub tokens remain active, keeping the campaign alive. **Source:** [Security Week](https://www.securityweek.com/shai-hulud-supply-chain-attack-worm-used-to-steal-secrets-180-npm-packages-hit/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fshai-hulud-worm-npm-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Hackers Are Using Fake Passkey Requests to Break Into Microsoft 365 Accounts Sep 11, 2026](https://codekeeper.co/ticker/microsoft-365-phishing-campaign-bypasses-mfa)

[OpenAI's AI Agents Found a Zero-Day Flaw—Then Broke Out of Their Sandbox Aug 11, 2026](https://codekeeper.co/ticker/ai-agents-exploit-jfrog-vulnerability)

[Cyberattacks Ransomware Attack Hits Norcross City Systems Sep 1, 2026](https://codekeeper.co/ticker/norcross-ga-ransomware-attack-recovery)

[Ransomware Gunra Ransomware Gang Exploits Fortinet Flaws and Bypasses MFA in Global Attacks Aug 14, 2026](https://codekeeper.co/ticker/gunra-ransomware-threatens-global-infrastructure)