New Shai-hulud Worm Infecting npm Packages With Millions of Downloads

ReversingLabs discovers "Shai-hulud," a self-replicating computer worm on the npm open-source registry. Learn how the malware steals developer…...

MAL-2025-47421 Malicious code in @strong-energetic/test-banned-file (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security beb2182dad9121d8cdfbd98f321d90cd62cda75f2c4ef68f1a5e22608808dc91 This package was compromised by the Shai-Hulud NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub...

Malicious code in ng-imports-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b18b9fde01428e5307224f34cca2ee013b4d455573e0da91abc9d6ee0c1438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47423 Malicious code in ng-imports-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b18b9fde01428e5307224f34cca2ee013b4d455573e0da91abc9d6ee0c1438 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ace-colorpicker-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 426138ee95f77b41d1c00a47edab8b076d8fef24aeddcacb76c601e67fea7312 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47293 Malicious code in ace-colorpicker-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 426138ee95f77b41d1c00a47edab8b076d8fef24aeddcacb76c601e67fea7312 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47290 Malicious code in @ui-ux-gang/devextreme-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc643d20a812778984d46636db2ea2e7e08c97ca2710b212c0b07a023461df59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pm2-gelf-json (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9729db241544847eced07c28de82e8cd2a4432b69f44d56de0289ab621fc1492 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @art-ws/db-context (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72aeba541e18c7562da7a71bea780fecdb34e6a64f033ee26245d2349ca786df Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @nativescript-community/ui-document-picker (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46d11dbb6f2ddb5b46be5e63a827af98e3f887baac9c3df11be485d8326089b2 This package was compromised by the Shai-Hulud NPM worm. The malicious payload steal...

Malicious code in capacitor-plugin-healthapp (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ed67ecd3a89635aa7072f0b0399ad7c1fa0f7805c8bbe59b9a775654e5acdab Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in airpilot (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 846d44d22101abc0b31169c4961dd524b15c20769cbc74a19e2119c6db6e174a Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in voip-callkit (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a734b4465eca2576dd3250f97ed37e8537b32d73d0b45adc3bca41bdd52c633c Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in create-hest-app (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4f8a7c74b24a78d61a35d81d643117f524f843b425f34d281012f7ab8632868 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in mcp-knowledge-graph (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e385978fdd606a1cfafadbcf800ed35523992d9a683305fcca51a6f12ea8b0f Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in capacitorandroidpermissions (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4db1dacd688bba52c2c6768ed56310450482ba27cf25b23de8a664943712b40d Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @art-ws/prettier (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0ad654106f2b917f883774d7484c2a6e0b8321808a7693b56ce60c52eaf85e3 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in config-cordova (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6be890bb2add4317485a3489a291b37fc52ecb9b16d9d5f5f1a6c67421c14c6 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @ui-ux-gang/devextreme-angular-rpk (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e5992d6feea9798115c98d409170302c758e89417f30a1fbef8e51a4b48f9a1 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in capacitor-notificationhandler (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f48b8279ed29432862fc6a0e1baa55481494de62d45c143694c11b696b235e Any computer that has this package installed or running should be considered fully compromised. All...