Shai-Hulud: lessons from the npm attack of 2025

*Archive article dated September 19, 2025. Reviewed and updated on September 8, 2026. This article covers the first Shai-Hulud campaign of September 2025; it is not a current alert or an all-clear.*

What happened

Shai-Hulud spread through compromised npm packages. Malicious code could run during installation, steal credentials and misuse them to publish further packages. GitHub confirmed compromised maintainer accounts and removed affected packages. The original Wiz investigation describes secret theft and propagation through accessible npm tokens.

What an affected team needs to investigate

A known vulnerability in a dependency and an already compromised development environment are different problems. Updating a version alone does not establish whether credentials were stolen.

A concrete suspicion belongs in an incident response process: isolate affected systems, preserve evidence, revoke exposed credentials and replace them from a clean environment. Package versions, installation times, build logs and suspicious repository changes help determine the scope. The appropriate response depends on the actual exposure.

What npm audit does

`npm audit` checks configured dependencies for known vulnerabilities. A report without findings does not prove that a system is free of malicious code or stolen credentials. `npm audit fix` performs installation steps, so it is not a universal first response on a potentially compromised environment. Updates and recovery require review and testing.

What this means for digital projects

Dependencies need clear ownership, traceable changes and verifiable build processes. Security review is part of website quality alongside design and usability. For a current incident, use the current guidance from maintainers and your security team.

Sources

• GitHub: npm security incidents in September 2025
• Wiz: investigation of the first Shai-Hulud campaign
• npm: how npm audit works and its limits