ReportedReported by fewer than three independent publishers, with no official finding.
Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub
Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in the npm registry in a new Shai-Hulud supply-chain campaign. The malicious packages have...
DII-2025-004012 sources ↓
What happened
Not publicly disclosed.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.
DataBreaches.net
Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub
24 November 2025