Aikido Security - Security Ticks

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack

Aikido Security, Don't miss, Hot stuff, JavaScript, News, Node.js, open source, ReversingLabs, StepSecurity, supply chain attacks, Wiz, worms / SecurityTicks

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack 2025-09-17 at 01:18 By Zeljka Zorz A potentially monumental supply chain attack is underway, thanks to a self-replicating worm-like payload that has been compromising packages published on the npm Registry. The worm has been dubbed “Shai-hulud” as it steals credentials from victims who […]

React to this headline:

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack Read More »

Fake npm 2FA reset email led to compromise of popular code packages

Fake npm 2FA reset email led to compromise of popular code packages 2025-09-09 at 16:51 By Zeljka Zorz Malicious versions of at least 18 widely used npm packages were uploaded to the npm Registry on Monday, following the compromise of their maintainer’s account. “The packages were updated to contain a piece of code that would

React to this headline: