Shai-Hulud npm Supply Chain Attack | Wiz Blog
· Source: wiz.io
In short
On September 15, 2025, multiple popular npm packages were compromised with a self-propagating malware called Shai-Hulud, which harvested sensitive data and spread through attacker-controlled GitHub repositories. This JavaScript supply chain attack, linked to a prior GitHub token theft, represents one of the most severe compromises in the npm ecosystem, exposing secret credentials and migrating private repositories to public status.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 38, 2025: Agentic AI Drives Autonomous Supply Chains with Measurable Cost and Speed Gains
Tags: security, supplychain, npm, malware, exfiltration, threat