On Nov. 24, security firm Aikido detected a second wave of the Shai-Hulud self-replicating npm worm, compromising 492 packages with a combined 132 million monthly downloads.
The attack struck major ecosystems, including AsyncAPI, PostHog, Postman, Zapier, and ENS, exploiting the final weeks before npm’s Dec. 9 deadline to revoke legacy authentication tokens.
Aikido’s triage queue flagged the intrusion around 3:16 AM UTC, as malicious versions of AsyncAPI’s go-template and 36 related packages began spreading across the registry.
The attacker labeled stolen-credential repositories with the description “Sha1-Hulud: The Second Coming,” maintaining theatrical branding from the September campaign.
The worm installs the Bun runtime during package setup, then executes malicious code that searches developer environments for exposed secrets using TruffleHog.
Compromised API keys, GitHub tokens, and npm credentials are published to randomly named public repositories, and the malware att
We współpracy z: https://cryptoslate.com/malicious-worm-compromises-crypto-domains-in-supply-chain-attack/
