Sep 14, 2025

Started

• Closed✓Patched

  Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike

  A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.

  npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)·Closed Sep 23, 2025·updated Sep 23, 2025