Cybersecurity researchers have uncovered a sophisticated supply chain attack dubbed “Shai-Hulud” that has compromised over 40 npm packages across multiple maintainers, marking what experts call the first self-replicating worm targeting the JavaScript ecosystem.
## How the Attack Works
The malicious campaign operates through a clever trojanization process. When activated, the compromised packages execute a function called `NpmModule.updatePackage` that:
– Downloads legitimate package files
– Modifies the package.json configuration
– Injects malicious code (bundle.js)
– Republishes the infected package
– Automatically spreads to downstream dependencies
This creates a cascading effect across the npm ecosystem, with each infected package becoming a vector for further compromise.
## Credential Theft and Data Exfiltration
The attack’s primary objective is stealing developer credentials and sensitive information. The malware:
– Uses TruffleHog, a legitimate security tool, to scan for secrets
– Targets critical tokens including GitHub, npm, and AWS credentials
– Creates persistent GitHub Actions workflows for ongoing data theft
– Exfiltrates stolen data to attacker-controlled servers
– Works on both Windows and Linux systems
## Affected Packages and Timeline
The attack began with the `rxnt-authentication` package on September 14, 2025, with the “techsupportrxnt” account identified as “Patient Zero.” Over 40 packages have been confirmed compromised, including popular libraries like:
– Multiple @ctrl/ packages (deluge, qbittorrent, transmission)
– @nativescript-community packages
– Angular and React components
– Development tools and utilities
Additionally, attackers used a fake “crowdstrike-publisher” account to distribute over 20 trojanized packages impersonating CrowdStrike products, though the company confirmed their actual platform remains unaffected.
## Industry Response and Connections
Security firms have identified concerning patterns linking this attack to the recent s1ngularity campaign that targeted the nx build system. The functional similarities suggest a coordinated effort by the same threat actors.
ReversingLabs reports identifying hundreds of potentially compromised packages, while OX Security discovered 34 compromised GitHub accounts containing stolen data. The self-propagating nature makes it difficult to predict the attack’s full scope.
## Parallel Threats: Rust Ecosystem Targeted
Simultaneously, the Rust community faces a separate phishing campaign using the typosquatted domain “rustfoundation[.]dev” to steal crates.io user credentials. The fake emails claim infrastructure compromise and direct users to malicious GitHub login pages.
## Immediate Actions Required
Developers should immediately:
1. Audit environments for affected packages
2. Rotate all npm tokens and cloud credentials
3. Remove malicious package versions
4. Check for unauthorized GitHub Actions workflows
5. Monitor repositories for suspicious “-migration” copies
This incident represents a significant evolution in supply chain attacks, demonstrating how malware can now automatically propagate through package dependencies, creating unprecedented risks for the entire JavaScript ecosystem.