This morning, we were alerted to a large-scale attack against npm. This appears to the be work of the same threat actors behind the Nx attack on August 27th 2025. This was originally published by Socket and StepSecurity who noted 40 packages had been comrpomised, since then an additional 147 packages have been infected with malware including packages from CrowdStrike.

The scale, scope and impact of this attack is significant. The attackers are using the same playbook in large parts as the original attack, but have stepped up their game. They have turned it into a full worm, which does these things automatically:

• Steal secrets and publish them to GitHub publicly
• Run trufflehog and query Cloud metadata endpoints to gather secrets
• Attempt to create a new GitHub action with a data exiltration mechanism through webhook[.]site
• Iterate the repositories on GitHub a user has access to, and make them public

Since our initial alert this morning we’ve confirmed the following additional behaviours and important details. For those that don’t know, Shai Hulud is the name for the worm in the Dune franchise. A clear indication of the intent of the attackers.