npm Supply Chain "Shai-Hulud" Worm Continues to Threaten Ecosystem
GitLab's Vulnerability Research team has identified an ongoing large-scale supply chain attack affecting tens of thousands of repositories, with evolved "Shai-Hulud" malware featuring worm-like propagation and a destructive "dead man's switch."
GitLab's Vulnerability Research team has identified an active, large-scale supply chain attack involving a destructive malware variant spreading through the npm ecosystem. Multiple infected packages contain an evolved version of the "Shai-Hulud" malware with worm-like propagation behavior that automatically infects additional packages maintained by impacted developers. The attack, which surfaced around November 21-24, 2025, and continues into 2026, affects over 25,000 malicious repositories across approximately 350 unique users.
Massive Scale and Compromised Credentials
Around 600-800 npm packages have been compromised, many of them widely used in production environments. Attackers have compromised maintainer accounts from prominent projects including Zapier, PostHog, and Postman. The malware has stolen extensive credentials: 581 GitHub Personal Access Tokens, 386 OAuth tokens, 104 Fine-Grained PATs, alongside 101 GitLab tokens. NPM tokens allowed attackers to publish packages and continue the supply chain attack.
Dead Man's Switch Mechanism
A particularly concerning aspect of Shai-Hulud 2.0 is its "dead man's switch" mechanism that threatens to destroy user data if its propagation and exfiltration channels are severed. This represents an escalation from traditional malware, introducing ransomware-like destructive capabilities into supply chain attacks. A new strain discovered on December 28, 2025, suggests the attackers continue to evolve their techniques.
Ongoing Threat
Security researchers from CISA, Microsoft, Palo Alto Networks' Unit42, Wiz, and GitGuardian have all published guidance on detecting and defending against the attack. Organizations using npm packages should audit their dependencies, rotate all credentials, and implement supply chain security tools to detect malicious package updates before they reach production systems.
Related Articles
Cloudflare 2026 Threat Report: 230 Billion Daily Blocked Threats and the Rise of Credential Attacks
Cloudflare has published its inaugural annual threat report revealing the company blocks over 230 billion threats daily across 20% of global web traffic. DDoS attacks doubled year-over-year to 47.1 million incidents, with the largest reaching a record 31.4 Tbps, while bots now account for 94% of all login attempts.
HashiCorp Patches Consul Arbitrary File Read Vulnerability in Kubernetes Auth
HashiCorp has released emergency patches for Consul to address CVE-2026-2808, a medium-severity vulnerability allowing arbitrary file reads when Kubernetes authentication is enabled. The fix also adds HTTP server timeouts to prevent Slowloris denial-of-service attacks against Consul agent endpoints.
Let's Encrypt Now Issues Six-Day Certificates and IP Address Certificates via Certbot
Let's Encrypt and the EFF have announced support for six-day (160-hour) certificates and IP address certificates through Certbot 5.3 and 5.4. The ultra-short-lived certificates reduce the impact window of compromised keys by design, while IP address certificates enable HTTPS for services identified by address rather than hostname.