# Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike · pwn.watch

> A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.

Page: https://pwn.watch/i/shai-hulud-npm-worm-september-2025 · generated 2026-10-22T22:54:30.229Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)
- Started: 2025-09-14 · closed: 2025-09-23
- Affected: Specific malicious versions of 500+ npm packages (see Socket / CISA lists)
- Fixed in: Malicious versions removed from npm; upgrade to versions published after the incident

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/shai-hulud-npm-worm-september-2025/feed.xml
- JSON Feed: https://pwn.watch/i/shai-hulud-npm-worm-september-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json
- This file: https://pwn.watch/i/shai-hulud-npm-worm-september-2025/llms.txt

## Updates (newest first)
- 2025-09-23: CISA alert: widespread supply chain compromise impacting npm (500+ packages) (https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- 2025-09-16: Largest burst, nearly 100 packages, including @crowdstrike scope (https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)
- 2025-09-15: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised (https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages)
- 2025-09-14: First compromised versions published (17:58 UTC) (https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)

## Fix brief
# Security brief: Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike

Source: https://pwn.watch/i/shai-hulud-npm-worm-september-2025 · status: closed (closed Sep 23, 2025) · severity: critical · updated Sep 23, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.

Severity detail: Self-replicating supply-chain worm; credential theft

- Product: npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)

## Affected versions
- Specific malicious versions of 500+ npm packages (see Socket / CISA lists)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Malicious versions removed from npm; upgrade to versions published after the incident

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Sep 23, 2025: CISA alert: widespread supply chain compromise impacting npm (500+ packages)
- Sep 16, 2025: Largest burst, nearly 100 packages, including @crowdstrike scope
- Sep 15, 2025: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised
- Sep 14, 2025: First compromised versions published (17:58 UTC)

## Advisories
- [Widespread Supply Chain Compromise Impacting npm Ecosystem](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem) (CISA)

## Write-ups & news
- [Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages](https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)
- [Shai-Hulud: The novel self-replicating worm infecting hundreds of NPM packages](https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages)
- [S1ngularity/nx attackers strike again](https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again)

## Caveats
CISA alert URL/date from memory of the 2025-09-23 alert; verify. Package counts vary by vendor (Socket ~500, isotope13 526).

---
Machine-readable: https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.