https://pwn.watch/i/shai-hulud-npm-worm-september-2025 A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages. en Tue, 23 Sep 2025 00:00:00 GMT https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-23-1a0dce8b Tue, 23 Sep 2025 00:00:00 GMT critical <p><a href="https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem">Source</a></p> https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-16-ab38d5b7 Tue, 16 Sep 2025 00:00:00 GMT critical <p><a href="https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages">Source</a></p> https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-15-ac1714b2 Mon, 15 Sep 2025 00:00:00 GMT critical <p><a href="https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages">Source</a></p> https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025#2025-09-14-4c400dd1 Sun, 14 Sep 2025 00:00:00 GMT critical <p><a href="https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages">Source</a></p>