Nov 24, 2025
1 new incident, 0 with updates.
Started
- ClosedCriticalPatched
Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)Closed Nov 26, 2025
