---
id: 6975
title: "Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"
published_at: "2025-09-16T14:04:50Z"
tags: ["supply-chain", "secrets", "malware", "npm", "worm", "shai-hulud", "wiz-research"]
phying_url: "https://phying.com/item/6975"
lang: en
---

# Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware

## Summary

Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-09-16T14:04:50Z
- **Original:** https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
- **Phying News:** https://phying.com/item/6975