The Npm Worm Outbreak
Find Threat Talks on
The Npm Worm Outbreak
For the first time, the world’s biggest open-source ecosystem saw a worm that spread on its own.
No botnet. No manual upload. Just automation – and trust – turned against developers.
When a maintainer got phished, Shai Hulud stole credentials, hijacked tokens, and created new CI/CD workflows to keep spreading automatically.
It didn’t stop at npm. It reached into GitHub and the cloud – exfiltrating secrets across environments.
Hosts Rob Maas (Field CTO, ON2IT) and Juri Wit (SOC Analyst, ON2IT) break down how the first self-replicating supply-chain worm worked – and what it means for every team building in the open.
What you’ll learn
- How Shai Hulud became the first-ever self-spreading supply-chain worm – and why that changes everything
- The attack chain: from one phished maintainer to a global infection
- How automation replaced command-and-control – and why that makes detection harder
- The real risk to developers: secrets, tokens, and CI/CD persistence
- Practical defense: pin dependencies, alert on new workflows, rotate credentials, monitor egress
This isn’t about one registry.
It’s about what happens when code learns to spread itself.
Your cybersecurity experts
Rob Maas
Field CTO
ON2IT
Yuri Wit
SOC Specialist
ON2IT
Episode details
It started with a phish – and ended as the first self-propagating worm in open-source history.
They called it Shai Hulud.
A compromised maintainer seeded malicious packages.
Once inside a developer’s system, the worm harvested GitHub, cloud, and npm tokens – then built new branches and CI/CD workflows named Shaihulud to maintain access and exfiltrate data automatically.
No central control. No uploads. Just a chain reaction through automation.
It targeted Linux and macOS, skipping Windows – aiming directly at developer environments.
The playbook for defense
- Dependency discipline: Pin and verify before you update.
- CI/CD hardening: Alert on new workflows, branches, and unexpected webhooks.
- Secrets hygiene: Scope, rotate, and watch for token reuse.
- Egress control: Inspect webhooks and block unknown destinations.
This was the first worm built for developers – not users.
EDR can’t stop it.
Good hygiene can.
Lock down your pipelines.
Before the next one writes itself.
Get your Hacker T-shirt
Join the treasure hunt!
Find the code within this episode and receive your own hacker t-shirt for free.
