Two billion downloads a week: the npm attacks of September 2025

Two attacks, one week apart

The crypto-clipper in chalk and debug

The code injected on 8 September ran in web browsers. It hooked fetch, XMLHttpRequest and wallet interfaces such as window.ethereum, watched for addresses on six blockchains, and replaced them with attacker addresses chosen to look similar — before the user signed.

Combined weekly downloads of the 18 packages

2B+Aikido Security

Stolen in total — about $0.05 in ETH plus meme tokens

≈$20Security Alliance, via Protos

Packages compromised by the Shai-Hulud worm

500+CISA (23 Sep 2025)

Shai-Hulud: the worm that published itself

The second attack aimed at developers rather than their users. Installing an infected version ran a hidden script that searched the machine for secrets — using the open-source scanner TruffleHog as well as environment variables and cloud metadata — and sent what it found to the attackers and to public GitHub repositories named “Shai-Hulud”. With a stolen npm token it then published infected versions of other packages that developer maintained. CISA reported GitHub tokens and AWS, Google Cloud and Azure keys among the targets.

Our reading

Analysis — Altumptic's interpretation of the reporting above.

• The fumble will not repeat. The September 8 payload ran in browsers, while most installs of these packages are build servers and command-line tools, and it was caught fast. The next attacker with the same reach will aim better.
• One-time codes are phishable. The maintainer had two-factor authentication. A code typed into a fake site works just as well for the attacker; hardware keys bound to the real domain do not.
• A token on a laptop is a publish button for everything. Shai-Hulud turned every infected developer into a distributor. Short-lived, scoped credentials and publishing from CI change that arithmetic.
• Clippers lose to independent verification. The clipper worked only if nobody compared the address with a second source — the same lesson as ALT-08, at retail scale.

Pinning a JavaScript supply chain

1. Install from the lockfile only (npm ci, or a frozen lockfile in other managers), never from floating version ranges in CI.
2. Do not adopt brand-new versions on day one; use a minimum release age where your package manager supports it.
3. Turn off dependency install scripts by default and allow them per package.
4. Publish through trusted publishing with provenance, and keep no long-lived npm or GitHub tokens on developer machines.
5. Use phishing-resistant keys (FIDO2 / WebAuthn) for npm and GitHub, and never act on emails asking you to “update 2FA”.
6. If you installed an affected version, rotate every credential that machine could read — not just npm.