What the Shai-Hulud npm Worm Means for Node.js Developers
The Node.js ecosystem has been disrupted by self-replicating malware called Shai-Hulud. In September 2025, researchers found that Shai-Hulud had infected more than 500 npm packages, including some from trusted maintainers. The worm did not just publish a few bad versions. It spread automatically, using stolen credentials to infect other packages owned by the same developer.