Shai-Hulud npm Worm Resurfaces After 111 Days and Slips Past Malware Scanning
A known malware worm has reappeared in npm packages, stealing developer access tokens to spread further. Attackers republish the same malicious code to trick developers into installing it.
- Severity
- Not scoredNo CVSS score recorded
How it works
- Attackers republished the same malicious npm package code that was used in May.
- When a developer installs any of these poisoned packages, the malware runs first.
- It searches for developer access tokens stored in the environment.
- If it finds one, it uses that token to push new malicious versions of other packages, spreading the worm further.
What to do
Check if you installed any npm packages published on September 7 by unknown or suspicious maintainers. Run npm ls --all | grep -i 'package-name' (replace 'package-name' with the names from the list below). If you see any of these packages installed, remove them immediately: npm uninstall package-name.
Remove any installed packages from the September 7 uploads. Update your npm access tokens by running npm config set ///:_authToken <new-token> with a fresh token from your npm account. Check your published packages for unauthorized changes at If you find any suspicious packages, report them to npm support and revoke compromised tokens immediately.
Technical details
A supply-chain attack resurfaced in the npm registry on September 7, 2024, after an 111-day gap, reusing the same malicious payload observed in a May 19, 2024, incident targeting the @antv packages. Four packages were uploaded within one hour by the same npm account, each embedding a backdoor that executes during dependency installation. The malware scans for npm access tokens, republishes modified versions of packages, and spreads further by abusing the victim's publishing privileges.
The payload's SHA-256 hash matches the one from May 19, confirming it is the same worm, now repackaged in unrelated packages. The attack exploits trusted developer workflows by disguising malicious code as a legitimate update, bypassing static malware scanning due to its unchanged fingerprint.