ClosedPatched

Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike

npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)

A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.

Why this severity: Self-replicating supply-chain worm; credential theft

Started: Sep 14, 2025
Closed: Sep 23, 2025

Follow this incident

Updated Sep 23, 2025

Affected

Specific malicious versions of 500+ npm packages (see Socket / CISA lists)

Fixed in

Malicious versions removed from npm; upgrade to versions published after the incident

Timeline4

Sep 23, 2025
CISA alert: widespread supply chain compromise impacting npm (500+ packages)
Source
Sep 16, 2025
Largest burst, nearly 100 packages, including @crowdstrike scope
Source
Sep 15, 2025
Worm discovered; @ctrl/tinycolor and ~40 packages found compromised
Source
Sep 14, 2025
First compromised versions published (17:58 UTC)
Source

Advisories1

Widespread Supply Chain Compromise Impacting npm EcosystemCISA · Sep 23, 2025

News & write-ups3

Notes & caveats

CISA alert URL/date from memory of the 2025-09-23 alert; verify. Package counts vary by vendor (Socket ~500, isotope13 526).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified