Self-replicating Worm hits 180+ npm packages to steal credentials in latest supply chain attack

Cyber security researchers have flagged a fresh software supply chain attack targeting the NPM (NPM  is one of the world's largest software registries, and the package manager for Node.js projects) registry that has affected more than 40 packages that belong to multiple maintainers.  

"The compromised versions include a function (NpmModule.updatePackage) that downloads a package tarball, modifies package.json, injects a local script (bundle.js), repacks the archive, and republishes it, enabling automatic trojanization of downstream packages," supply chain security company Socket said. 

The end goal of the campaign is to search developer machines for secrets using TruffleHog's credential scanner and transmit them to an external server under the attacker's control. The attack is capable of targeting both Windows and Linux systems. 

More Than 500 Packages Impacted 

A cluster of malicious npm packages contain a trojanized bundle.js that runs TruffleHog to scan hosts for secrets (e.g., GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY). The script validates tokens (npm whoami, GitHub APIs), probes cloud metadata for short-lived credentials on build agents, and then abuses discovered developer credentials to commit a GitHub Actions workflow into .github/workflows that exfiltrates harvested secrets to a webhook.site endpoint. Because the workflow is committed to repositories, the exfiltration capability persists and can be triggered by future CI runs where secrets are available. 

Security vendors describe the malware — dubbed Shai-Hulud — as a self-propagating worm: compromised npm maintainer accounts are used to publish new malicious package versions that in turn infect downstream packages and repositories, creating cascading compromises across the npm ecosystem. The campaign’s suspected starting point is a malicious rxnt-authentication package published on 2025-09-14; the npm account techsupportrxnt is considered “Patient Zero.” Analysts found 34 compromised GitHub accounts containing a Shai-Hulud repo with a data.json holding encoded exfiltrated items, and an analysis identified 278 leaked secrets (90 from local systems, 188 via malicious workflows), with hundreds of npm packages impacted. 

This attack is notable for combining credential harvesting, persistent CI-side exfiltration, and automatic propagation via maintainers’ publishing rights. Recommended immediate actions are to remove the malicious package versions, rotate all exposed tokens/keys, audit CI workflows and repository history for unauthorized .github/workflows commits, inspect maintainers’ accounts for compromise, and upgrade to verified clean releases. 

Affected Packages: 

The following packages have been identified as impacted by the incident@ctrl/deluge@7.2.2 

What You Should Do 

As a minimum containment measures you should: 

• Remove/downgrade affected versions and rebuild from a clean cache/artifact source. 

• Rotate/revoke and replace credentials used on any affected machine or CI runner (npm tokens, GitHub PATs/Actions secrets, cloud keys). 

• Audit logs for signs of suspicious installs, unauthorized publishes or automated workflow files. 

• Check GitHub for a new repo named “Shai-Hulud”. This campaign creates a public repo under victims’ accounts to dump stolen data. If found, remove it, review its contents/history to better understand the scope of the leak. 

However, overall the affected machines should be considered fully compromised. Therefore, full reinstall\reimaging is preferred. 

References: 

• https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html 

• https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hit-in-major-supply-chain-attack/ 

 If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation.