Sep 15, 2025
0 new incidents, 2 with updates.
Updated
- ClosedCriticalPatched
Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.
npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)Closed Sep 23, 2025
- ClosedCriticalPatched
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 moreClosed Sep 13, 2025
