Urgent: npm Supply Chain Attack—What Developers Need to Know (September 2025)

A self-replicating malware, dubbed the "Shai-Hulud" worm, compromised over 180 (and potentially up to 500) npm packages, including some of the ecosystem's most widely used modules like chalk, debug, and ansi-styles. The attack began when npm maintainers were targeted with sophisticated phishing emails mimicking npm support, tricking them into handing over privileged credentials.

Once an account was breached, attackers published malicious updates to multiple packages. These updates included code designed to steal secrets such as npm tokens, GitHub PATs, and cloud API keys from developer environments. The malware didn't stop there—it then used the stolen credentials to propagate itself, compromising other packages owned by affected maintainers and uploading the stolen data to a public GitHub repository.

Trust in a widely-used package can be weaponized at scale in a matter of hours.

Packages named in the attack#

What should you do?#

• Immediately review all dependencies in your projects for suspicious or recently updated packages.
• Revoke and regenerate any possibly exposed API tokens and credentials.
• Ensure your npm and GitHub accounts have two-factor authentication enabled.

Check your lock file#

Run this in your project to see which version of an affected package you have installed. Compare it with the versions listed in the official advisories.

npm ls chalk debug ansi-styles

If a compromised version shows up, follow these steps in order:

1. 1Delete node_modules and your lock file.
2. 2Pin the package to a safe version in package.json.
3. 3Run npm install again and commit the new lock file.
4. 4Rotate every token and key that was available on that machine.

This incident highlights the growing threat of software supply chain attacks, where trust in widely-used packages can be weaponized at scale. Stay vigilant, audit your dependencies, and keep your systems secure.

References#

• Ongoing npm Software Supply Chain Attack Exposes New Risks
• Inside the September 2025 NPM Supply Chain Attack
• "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack
• Self-Replicating Worm Compromises 500+ NPM Packages