What the Shai-Hulud npm Worm Means for Node.js Developers

The Node.js ecosystem has been disrupted by self-replicating malware called Shai-Hulud.

In September 2025, researchers found that Shai-Hulud had infected more than 500 npm packages, including some from trusted maintainers. The worm did not just publish a few bad versions. It spread automatically, using stolen credentials to infect other packages owned by the same developer.

How the Attack Worked

When a developer or build system installed an infected package, Shai-Hulud searched for secrets such as npm tokens, GitHub access tokens, and cloud credentials. It then used those credentials to publish new malicious versions of other packages owned by that developer.

It also:

• Added hidden GitHub Actions workflows that sent data to attacker-controlled servers.
• Created public repositories named Shai-Hulud containing encoded files of stolen credentials.
• Tried to make private repositories public under the name “Shai-Hulud Migration.”

This was the first time a self-spreading worm appeared in the npm ecosystem.

What Node.js Users Should Do

If your environment uses Node.js or npm, take these steps:

1. Audit dependencies
   • Check your package-lock.json or yarn.lock files for known compromised packages (lists are available from Wiz, JFrog, and CISA).
   • Reinstall from trusted sources and lock versions.
2. Rotate credentials
   • Treat npm and GitHub tokens as potentially exposed.
   • Reissue publication tokens, SSH keys, and API keys used in builds.
3. Inspect repositories
   • Look for unfamiliar branches or workflows named shai-hulud.
   • Review GitHub audit logs for unexpected changes.
4. Harden CI/CD pipelines
   • Use scoped, temporary credentials.
   • Avoid running builds with unnecessary write privileges.

If You Think Your System Might Be Affected

If your organization uses Node.js—on IBM i or elsewhere—and you’d like help assessing exposure or improving security, Seiden Group’s SmartSupport team can assist.

Contact Seiden Group to schedule a confidential review or plan a proactive security strategy.