Security Advisory | NPM Packages Using Secret Scanning Tools to Steal Credentials

We are aware of a number of compromised npm packages using a novel secret scanning tool method. We are investigating if any of our customers are impacted. We'll share additional analysis from our security research team about this latest compromise that may prove helpful.

• 187+ packages discovered so far, the compromise uses a self-replicating worm though so we do expect this number to increase. We're updating Supply Chain rules as the signs of compromise are detected. See Compromised Package inventory below.

• One initial compromised package (@ctrl/tinycolor) has > 8 million monthly downloads.

• Extends beyond single namespace and includes @ngx, @nativescript-community, and more.

• Steals credentials by fetching from the process environment (AWS keys, GitHub/NPM tokens, etc.) using Trufflehog to scan the filesystem and check if keys are valid.

• Exfiltrates secrets to a webhook.site endpoint, and a public GitHub repo.

• NPM is rapidly unpublishing compromised versions, but this attack behaves like a worm, scanning hosts for secrets, credentials and tokens. It then exfiltrates this plus environment variables and other system info creating a public repository called Shai-Hulud. Using GitHub actions it then uses a workflow to POST results to an attacker controlled website. If additional valid npm tokens are found, it will then enumerate packages and update them to further spread the malware.

• Similar to recent the Nx incident, private repositories are being exposed as public migration copies.

Semgrep Supply Chain has released Semgrep Rules to detect the use of these vulnerable versions. Supply Chain customers can run scans to update Semgrep's record of their dependencies, then use findings filters to check whether they're vulnerable. If you see findings in that filter, we recommend upgrading to the latest safe version of the affected dependency or downgrading to the last safe version from before the attack took place. There are some additional triage and best practice recommendations to consider included below.

Security Advisory Updates

If additional guidance is necessary we’ll provide updates here as they are available.

2025-09-22 | 17:40PM PDT (12:40 AM UTC)

Updated blog to include updated findings filters

2025-09-22 | 11:49am PDT (18:49pm UTC)

Updated blog to include more indicator of compromises (IoCs)

2025-09-16 | 01:57am PDT (08:56am UTC)

Aikido is currently tracking additional packages affected in their malware tracker and their blog.

We updated the list of affected versions in this post and rules from discovery of additional waves of compromised packages. We are observing cases where multiple versions are malicious, not only a single released version.

2025-09-16 | 12:03am PDT (7:03am UTC)

Step Security published a blog post with a detailed technical analysis of the worm-like behavior to use any captured secrets to infect additional NPM packages.

https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised

2025-09-15 | 04:23pm PDT (11:23pm UTC)

Socket Research published a blog post with a detailed technical analysis:

https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

2025-09-15 | 3:45pm PDT (10:23pm UTC)

Reported to the tinycolor project: https://github.com/scttcper/tinycolor/issues/256

2025-09-15 | 11:11am PDT (06:41pm UTC)

Early posts on social media about suspicious activity.

Recommendations for Triage 

Additional steps you could take:

Review your GitHub Security Log

You can use the following GitHub search to find Shai-Hulud related repositories or the encoded exfiltration data. However as GitHub unindexs these search results, this is not enough to assume you have not been compromised.

You should review the https://github.com/settings/security-log for irregular activity within your organizations, looking for newly created repositories.

• Repo create - https://github.com/settings/security-log?q=operation%3Acreate

• Repo rename - https://github.com/settings/security-log?q=action%3Arepo.rename++

Check Logs for Activity

• Review if you leveraged either @latest at the time of compromise, or utilized a compromised version from the list below.

• Review npm logs (~/.npm/_logs), and review if the postinstall node bundle.js is executed

• You can also look at your system to see if the bundle.js hash exists

  • find . -type f -name "*.js" -exec sha256sum {} \; | grep -E "de0e25a3e6c1e1e5998b306b7141b3dc4c0088da9d7bb47c1c00c91e6e4f85d6|81d2a004a1bca6ef87a1caf7d0e0b355ad1764238e40ff6d1b1cb77ad4f595c3|83a650ce44b2a9854802a7fb4c202877815274c129af49e6c2d1d5d5d55c501e|4b2399646573bb737c4969563303d8ee2e9ddbd1b271f1ca9e35ea78062538db|dc67467a39b70d1cd4c1f7f7a459b35058163592f4a9e8fb4dffcbba98ef210c|46faab8ab153fae6e80e7cca38eab363075bb524edd79e42269217a083628f09|b74caeaa75e077c99f7d44f46daaf9796a3be43ecf24f2a1fd381844669da777"

• Review your system logs, and CI/CD build systems to verify no calls were made to webhook[.]site to the path bb8ca5f6-4175-45d2-b042-fc9ebb8170b7.

• If you use endpoint software such as Crowdstrike, you can search for command line queries for the commands used in the exploit payload and domains queried during compromise

Rotate Credentials if Concerned

Rotate all credentials that were compromised and audit logs to determine if additional actions or persistence were attempted with the compromised tokens.

Remove Malicious Code

If you believe you are impacted you can remove the malicious package via:

• rm -rf node_modules && npm cache clean --force

The shai-hulud-workflow.yml may be left behind as an artifact. Remove it if discovered.

Additional NPM Registry Security Advice

Reducing Run Scripts

If your application doesn’t require them from dependencies regularly, you can ignore run-scripts and avoid executing arbitrary code in post install hooks. 

• Executing builds with npm install –ignore-scripts

• Setting ignore-scripts=true in .npmrc

Some packages do require installation steps though so this may not be feasible for all cases.

Maintainers Should Audit Publish History

If you maintain any packages on npm it may be a good idea to check your publishing history to ensure no unauthorized distribution of builds.

Consider Using pnpm

The pnpm tool has some benefits for performance and disk utilization. Added in the 10.16 release notes was a new minimumReleaseAge feature. It specifies the number of minutes a version should be live before considering it for installation. For instance, setting to a value of 1440 can ensure malicious dependencies have time to be caught before installed. There is also a minimumReleaseAgeExclude setting for exceptions where you really do want the latest.

Vulnerable Package Inventory

Here is a list of the packages and first versions known to be compromised.