{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:42:00.965Z",
  "tag": {
    "id": "shai-hulud",
    "label": "Shai-Hulud",
    "isStack": false,
    "url": "https://pwn.watch/t/shai-hulud",
    "feed": "https://pwn.watch/t/shai-hulud/feed.xml"
  },
  "counts": {
    "incidents": 6,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "tensorlake-npm-shai-hulud-worm",
      "title": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm",
      "json": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "tensorlake (npm)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [
        "GHSA-8g63-53c9-65j2"
      ],
      "affectedVersions": [
        "0.5.144"
      ],
      "fixedVersions": [
        "0.5.143 (safe pin); remove 0.5.144"
      ],
      "startedAt": "2026-10-07",
      "closedAt": null,
      "updatedAt": "2026-10-22T18:15:27+02:00",
      "summary": "On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-chaindrop-npm-keyv-august",
      "title": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august",
      "json": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)"
      ],
      "fixedVersions": [
        "Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default"
      ],
      "startedAt": "2026-08-04",
      "closedAt": "2026-08-15",
      "updatedAt": "2026-08-15",
      "summary": "In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-antv-npm-may",
      "title": "Mini Shai-Hulud hits AntV / timeago.js npm ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-antv-npm-may",
      "json": "https://pwn.watch/i/shai-hulud-antv-npm-may.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm @antv/*, timeago.js, related packages under atool",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Malicious versions published during May 2026 campaign window"
      ],
      "fixedVersions": [
        "Remove malicious versions; rotate CI/cloud secrets; pin clean releases"
      ],
      "startedAt": "2026-05-19",
      "closedAt": "2026-06-01",
      "updatedAt": "2026-06-01",
      "summary": "May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.",
      "xPost": null
    },
    {
      "slug": "openai-employee-devices-tanstack-shai-hulud",
      "title": "OpenAI employee devices hit via TanStack Mini Shai-Hulud wave",
      "url": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud",
      "json": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "TanStack-related npm packages / OpenAI employee endpoints",
      "tags": [
        "node",
        "npm",
        "openai",
        "tanstack",
        "shai-hulud",
        "supply-chain",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised TanStack package versions in the May wave"
      ],
      "fixedVersions": [],
      "startedAt": "2026-05-01",
      "closedAt": "2026-05-31",
      "updatedAt": "2026-05-31",
      "summary": "In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-2-npm-worm-november-2025",
      "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025",
      "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)",
      "tags": [
        "npm",
        "node",
        "shai-hulud",
        "posthog",
        "postman",
        "zapier",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)"
      ],
      "fixedVersions": [
        "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor"
      ],
      "startedAt": "2025-11-24",
      "closedAt": "2025-11-26",
      "updatedAt": "2025-11-26",
      "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-npm-worm-september-2025",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025",
      "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "shai-hulud",
        "crowdstrike",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Specific malicious versions of 500+ npm packages (see Socket / CISA lists)"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm; upgrade to versions published after the incident"
      ],
      "startedAt": "2025-09-14",
      "closedAt": "2025-09-23",
      "updatedAt": "2025-09-23",
      "summary": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Bhavesh Verma",
      "handle": "xbhaveshverma",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102764953153474560/GdTC_kqB_bigger.jpg",
      "text": "Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked\n \nOn October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was",
      "date": "2026-10-14T07:30:00.000Z",
      "url": "https://x.com/xbhaveshverma/status/2110271890346623049",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "sunil kumawat",
      "handle": "Sunil_kumawat17",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098057965584732161/FSLSFQ4M_bigger.jpg",
      "text": "1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs.\n\nTreat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.",
      "date": "2026-10-12T03:42:11.000Z",
      "url": "https://x.com/Sunil_kumawat17/status/2109489785181991309",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "Techzine",
      "handle": "techzine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1240303566201511936/gHRGR8Fs_bigger.png",
      "text": "The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.​it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more https://t.co/mLg7PlLPhr",
      "date": "2026-10-09T07:37:16.000Z",
      "url": "https://x.com/techzine/status/2108461779328332283",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HULCz6Ga8AE7wrg.jpg"
        }
      ],
      "incident": "tensorlake-npm-shai-hulud-worm"
    }
  ],
  "changes": [
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "0.5.144 published via the project’s release workflow.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08+",
      "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-07",
      "title": "Malicious commits land on tensorlakeai/tensorlake main.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04",
      "title": "keyv/cacheable malicious releases observed; worm begins propagating.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04/06",
      "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "GitHub privatizes malicious repos; public count drops to ~300",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "PostHog publishes its post-mortem",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "First compromised package published (03:10 UTC)",
      "body": null,
      "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Postman unpublishes 17 infected packages (51 versions)",
      "body": null,
      "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Last compromised package seen (~17:00-18:00 UTC)",
      "body": null,
      "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-23",
      "title": "CISA alert: widespread supply chain compromise impacting npm (500+ packages)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-16",
      "title": "Largest burst, nearly 100 packages, including @crowdstrike scope",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Worm discovered; @ctrl/tinycolor and ~40 packages found compromised",
      "body": null,
      "sourceUrl": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-14",
      "title": "First compromised versions published (17:58 UTC)",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    }
  ]
}