Developers woke to alarms on November 24, 2025, as Shai-Hulud malware resurfaced in a bolder attack.
This “Second Coming” affected over 800 npm packages from firms such as Zapier, ENS Domains, AsyncAPI, PostHog, and Postman.
It exposed secrets from 25,000+ GitHub repositories, timed to coincide with npm’s classic token revocation on December 9.
Shai-Hulud acts as a self-spreading worm, inspired by Dune’s sandworms. It slips into the post-install scripts of trojanized packages.
On execution, setup_bun.js checks for Bun runtime; if missing, it downloads and installs Bun via official scripts curl for Unix, PowerShell for Windows.
It then reloads PATH, scans shell profiles such as .bashrc, and runs the core payload, bun_environment.js.
The malware hunts credentials using TruffleHog, scanning for API keys, tokens, and secrets.
It creates random GitHub repos tagged “Sha1-Hulud: The Second Coming” and publicly dumps the findings.
Attackers push up to 100 new malicious packages per victim, versus 20 in September’s first wave failure to authenticate triggers a wipe of the user’s home directory.
Patient zero hit at 3:16 AM GMT: go-template and 36 AsyncAPI packages, spreading to PostHog by 4:11 AM and Postman by 5:09 AM.
Affected scopes total 132 million monthly downloads, including @posthog/cli, @ensdomains/ensjs, and @postman/postman-collection-fork.
Community errors amplified spread some packages bundled only staging code, missing the whole worm, limiting damage.
The assault hit high-profile projects: AsyncAPI’s CLI branch deployed malware; ENS, Zapier, and others leaked build secrets.
Firms responded quickly PostHog and Postman posted status updates and rotated keys. GitLab flagged widespread npm risks; Wiz tallied 25,000+ exposed repos across 500 users.
Teams face credential theft in CI/CD pipelines, enabling further breaches. Quick audits reveal infections via suspicious repos or downloads.
Defend now:
This wave underscores npm’s fragility amid token deadlines. Developers must harden habits to starve future worms.
PortSwigger has leveled up Burp Suite's scanning arsenal with the latest Active Scan++ extension, version…
Unit 42 researchers at Palo Alto Networks exposed serious flaws in the Model Context Protocol…
Polish police have arrested three Ukrainian men traveling through Europe and seized a cache of…
Google has launched its most significant Chrome update ever, embedding Gemini AI across the browser…
Attackers exploit this vulnerability through the router's web interface components, specifically "cgibin" and "hnap_main," by…
Security researchers have uncovered a severe flaw in Apache Tika, a popular open-source toolkit for…