https://pwn.watch/t/shai-hulud Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:42:01 GMT https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08:0.5.144 published via the project’s release workflow. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-08+:StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke. Thu, 08 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/tensorlake-npm-shai-hulud-worm tensorlake-npm-shai-hulud-worm:2026-10-07:Malicious commits land on tensorlakeai/tensorlake main. Wed, 07 Oct 2026 00:00:00 GMT critical Status: live, partial https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04:keyv/cacheable malicious releases observed; worm begins propagating. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august shai-hulud-chaindrop-npm-keyv-august:2026-08-04/06:Microsoft, Elastic, JFrog publish analyses; 400+ packages listed. Tue, 04 Aug 2026 00:00:00 GMT critical Status: closed, partial https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:GitHub privatizes malicious repos; public count drops to ~300 Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack Status: closed, patched https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-26:PostHog publishes its post-mortem Wed, 26 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:First compromised package published (03:10 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign Status: closed, patched https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem Status: closed, patched https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Postman unpublishes 17 infected packages (51 versions) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/ Status: closed, patched https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 shai-hulud-2-npm-worm-november-2025:2025-11-24:Last compromised package seen (~17:00-18:00 UTC) Mon, 24 Nov 2025 00:00:00 GMT critical Source: https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ Status: closed, patched https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-23:CISA alert: widespread supply chain compromise impacting npm (500+ packages) Tue, 23 Sep 2025 00:00:00 GMT critical Source: https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem Status: closed, patched https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-16:Largest burst, nearly 100 packages, including @crowdstrike scope Tue, 16 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-15:Worm discovered; @ctrl/tinycolor and ~40 packages found compromised Mon, 15 Sep 2025 00:00:00 GMT critical Source: https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages Status: closed, patched https://pwn.watch/i/shai-hulud-npm-worm-september-2025 shai-hulud-npm-worm-september-2025:2025-09-14:First compromised versions published (17:58 UTC) Sun, 14 Sep 2025 00:00:00 GMT critical Source: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages Status: closed, patched