{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike · updates",
  "home_page_url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025",
  "feed_url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025/feed.json",
  "description": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.",
  "language": "en",
  "_pwn": {
    "slug": "shai-hulud-npm-worm-september-2025",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025/feed.xml",
    "llms": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025/llms.txt",
    "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-23-1a0dce8b",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-23-1a0dce8b",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: CISA alert: widespread supply chain compromise impacting npm (500+ packages)",
      "content_text": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: CISA alert: widespread supply chain compromise impacting npm (500+ packages)\n\nSource: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "date_published": "2025-09-23T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-16-ab38d5b7",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-16-ab38d5b7",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Largest burst, nearly 100 packages, including @crowdstrike scope",
      "content_text": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Largest burst, nearly 100 packages, including @crowdstrike scope\n\nSource: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "date_published": "2025-09-16T00:00:00.000Z",
      "external_url": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-15-ac1714b2",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-15-ac1714b2",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised",
      "content_text": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised\n\nSource: https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "date_published": "2025-09-15T00:00:00.000Z",
      "external_url": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-14-4c400dd1",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-14-4c400dd1",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: First compromised versions published (17:58 UTC)",
      "content_text": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike: First compromised versions published (17:58 UTC)\n\nSource: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "date_published": "2025-09-14T00:00:00.000Z",
      "external_url": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "tags": [
        "critical"
      ]
    }
  ]
}