Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
A malware capable of devouring data in “smash-and-grab” style attacks also compromised several CrowdStrike code packages before the company removed them.
Following hot on the heels of the compromise of dozens of code packages hosted on JavaScript coding site npm, security analysts at Aikido have revealed that hundreds more code packages have been compromised by a self-replicating malware worm dubbed Shai-Hulud*.
According to Aikido researcher Charlie Eriksen, the attack bears the same hallmarks as one carried out against coding firm Nx in August. However, this campaign appears far more potentially damaging.
“The scale, scope and impact of this attack is significant,” Eriksen said in a 16 September blog post.
“The attackers are using the same playbook in large parts as the original attack, but have stepped up their game.”
The worm – named Shai-Hulud by security researcher Brian Krebs after GitHub repositories linked to the malware – has so far infected 187 code packages, including ctrl/tinycolor, which alone is downloaded roughly 2 million times every week.
CrowdStrike revealed that several of its code packages had been impacted, but the packages were removed, and the company rapidly rotated its public registry keys.
“These packages are not used in the Falcon sensor, the platform is not impacted, and customers remain protected,” CrowdStrike said in a widely reported statement.
“We are working with NPM and conducting a thorough investigation.”
The worm is capable of harvesting and exfiltrating stolen credentials and tokens and then publishing that data to a Shai-Hulud repository. Most worryingly, the worm is capable of copying itself into other npm code packages, no doubt causing many security analysts and coders to consider reciting the Bene Gesserit Litany Against Fear.
“This cycle allows the malware to continuously infect every package a maintainer has access to,” Eriksen said.
“Each published package becomes a new distribution vector: as soon as someone installs it, the worm executes, replicates, and pushes itself further into the ecosystem.
“In short: the attacker doesn’t need to manually target packages. Once a single environment is compromised, the worm automates the spread by piggybacking on the maintainer’s own publishing rights.”
Amir Landau, CyberArk Labs’ malware research team lead, said that such supply chain attacks were becoming increasingly more common.
“This attack methodology, which abuses legitimate tools, sites, and services, is becoming increasingly common in supply chain attacks aimed at poisoning development environments or stealing credentials for malicious purposes,” Landau said.
“The trend of supply chain attacks is accelerating both in frequency and impact, with 2025 experiencing an unprecedented wave of such attacks on npm and open-source ecosystems. In today’s environment, vibe coding tools like cursor and base44 can deploy untested packages in your environment, making it crucial to separate these environments from production and development surfaces.”
Aikido recommends cleaning your npm cache, reinstalling all code packages, and checking the versions of all code packages. You can find a full list of the compromised packages, and more information on the worm, here.
*Shai-Hulud is the Fremen name of the great worms of the desert planet of Arrakis in the popular Dune novels published by Frank Herbert.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
