How the September 2025 npm worm spread
CISA described stolen credentials, malicious package releases and checks for affected dependency trees.
Originally posted · Published here · 1 source · Resume reading
CISA's 2025-09-23 alert described Shai-Hulud as a self-replicating worm affecting more than 500 npm packages. The malware searched for developer credentials, exposed stolen secrets and used compromised accounts to publish infected package versions. [1]
Check dependencies and credentials together
The alert advised reviewing lockfiles, including nested dependencies, and checking cached packages in artifact repositories. Removing a direct dependency alone can miss another copy installed through a different package. [1]
CISA also recommended rotating developer credentials, using phishing-resistant multifactor authentication and reviewing GitHub applications, webhooks and secrets. Treat a credential exposed by an affected environment as compromised even after removing the package. [1]
Keep the incident date attached
The advisory's package cutoffs apply to that September incident. They are not a permanent safe-version rule for every later package release. Use the incident's indicators alongside current advisories when investigating a specific installation.
Keep this guide
Filed under Security
Sources
- CISA npm compromise alertcontent.govdelivery.com