Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
Why this severity: Self-replicating supply-chain worm; preinstall credential theft
- Started
- Nov 24, 2025
- Closed
- Nov 26, 2025
Affected
- e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)
Fixed in
- Malicious versions unpublished; use versions published after 2025-11-24 per each vendor
Timeline6
GitHub privatizes malicious repos; public count drops to ~300
SourcePostHog publishes its post-mortem
SourceFirst compromised package published (03:10 UTC)
SourcePostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC
SourcePostman unpublishes 17 infected packages (51 versions)
SourceLast compromised package seen (~17:00-18:00 UTC)
Source
News & write-ups5
- Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing SecretsWiz · Nov 24, 2025 · Write-up
- The Shai-Hulud 2.0 npm worm: analysis, and what you need to knowDatadog Security Labs · Write-up
- Post-mortem of Shai-Hulud attack on November 24th, 2025PostHog · Nov 26, 2025 · Write-up
- Shai-Hulud 2.0 npm supply-chain attackPostman · Nov 24, 2025 · Write-up
- A Data-Driven Analysis of the Sha1-Hulud 2.0 CampaignPanther · Write-up
Get an email when a new major security incident drops. No spam, unsubscribe any time.
