---
id: 1157
title: "Shai-Hulud 2.0: What Security Leaders Need to Do Now"
source_domain: hackerone.com
source_url: "https://www.hackerone.com/blog/shai-hulud-2-npm-worm-supply-chain-attack"
published_at: "2025-11-26 15:05"
tags: ["supply-chain", "secrets", "malware", "credential-theft", "npm", "ci-cd", "javascript", "worm", "shai-hulud"]
phying_url: "https://phying.com/item/1157"
lang: en
---

# Shai-Hulud 2.0: What Security Leaders Need to Do Now

## Summary

Shai-Hulud 2.0 is a self-replicating npm worm stealing secrets from dev and CI/CD environments; with 1,000+ packages and 27,000+ repos hit, rotate credentials and disable lifecycle scripts.

## Intelligence Metadata

- **Sources:** hackerone.com
- **Published:** 2025-11-26 15:05
- **Original:** https://www.hackerone.com/blog/shai-hulud-2-npm-worm-supply-chain-attack
- **Phying News:** https://phying.com/item/1157