{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T23:39:04.690Z",
  "tag": {
    "id": "postman",
    "label": "Postman",
    "isStack": false,
    "url": "https://pwn.watch/t/postman",
    "feed": "https://pwn.watch/t/postman/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "shai-hulud-2-npm-worm-november-2025",
      "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025",
      "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)",
      "tags": [
        "npm",
        "node",
        "shai-hulud",
        "posthog",
        "postman",
        "zapier",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)"
      ],
      "fixedVersions": [
        "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor"
      ],
      "startedAt": "2025-11-24",
      "closedAt": "2025-11-26",
      "updatedAt": "2025-11-26",
      "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "GitHub privatizes malicious repos; public count drops to ~300",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "PostHog publishes its post-mortem",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "First compromised package published (03:10 UTC)",
      "body": null,
      "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Postman unpublishes 17 infected packages (51 versions)",
      "body": null,
      "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Last compromised package seen (~17:00-18:00 UTC)",
      "body": null,
      "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    }
  ]
}