Worm
Security incidents tagged Worm. Newest first.
1 Worm incident in the last 12 months
- Incidents
- 3
- Live
- 0
- Patched
- 3
- Days without an incident
- 330
- Longest quiet run: 330 days (Nov 27–Oct 22)
Show 3 older incidents3 older incidents
November 2025 1
- CriticalPatched
Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)Closed Nov 26, 2025
October 2025 1
HighGlassWorm: self-spreading VS Code / OpenVSX extension worm hidden in invisible UnicodePatched
VS Code extensions on OpenVSX and the VS Code Marketplace Patched
Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.
September 2025 1
- CriticalPatched
Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.
npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)Closed Sep 23, 2025
