# How the September 2025 npm worm spread

> CISA described stolen credentials, malicious package releases and checks for affected dependency trees.

Source: https://fullbytedeveloper.com/blog/shai-hulud-npm-worm-response
Originally posted: 2025-09-18
Published here: 2026-11-06

CISA's 2025-09-23 alert described Shai-Hulud as a self-replicating worm affecting more than 500 npm packages. The malware searched for developer credentials, exposed stolen secrets and used compromised accounts to publish infected package versions. [1]

## Check dependencies and credentials together

The alert advised reviewing lockfiles, including nested dependencies, and checking cached packages in artifact repositories. Removing a direct dependency alone can miss another copy installed through a different package. [1]

CISA also recommended rotating developer credentials, using phishing-resistant multifactor authentication and reviewing GitHub applications, webhooks and secrets. Treat a credential exposed by an affected environment as compromised even after removing the package. [1]

## Keep the incident date attached

The advisory's package cutoffs apply to that September incident. They are not a permanent safe-version rule for every later package release. Use the incident's indicators alongside current advisories when investigating a specific installation.

## Sources

1. [CISA npm compromise alert](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/3f408db)

## Original posts

- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/DOvYl3qjDZv/)