Shai-Hulud worm
Named by 9 kept items in this workspace.
Search every workspace for Shai-Hulud worm. It matches the name as written, so it can find other things that share it.
The items that name it 9
software supply chain attack on open source packages, cited as a recent incident
new variant, linked by Aikido to the Tensorlake npm compromise; sets a unique global WORMTAG marker before launching its hidden logic
Self-replicating npm supply-chain malware worm; this is a novel variant/wave distinct from prior Shai-Hulud waves, distinguishing itself via a global WORMTAG marker, first observed in this campaign on 8 October 2026.
npm, September 2025; spread via postinstall scripts, persisted by writing a hook into Claude Code's settings file
npm malware campaign occurring 'this week' per the article, part of recent npm malware campaigns
Worm written and then open-sourced by an attacker to help other attackers use it, observed in software supply chain attacks
In 2025, spread across 500 or more npm package versions on its own
Supply chain worm targeting npm; Aikido Intel was among the first to report it. A more dangerous second wave in November hit high-profile packages from Zapier, PostHog, and ENS Domains; Charlie Eriksen validated and published a list of 400+ infected npm packages, including packages with over 1.5m we
Self-replicating npm worm campaign that uses stolen tokens to propagate itself across the npm ecosystem; attempts to read /proc/pid/mem to extract secrets and exfiltrate stolen credentials. StepSecurity reported on 'the latest Shai-Hulud worm campaign' and 'earlier waves of the Shai-Hulud campaign.'
All threat actors in this workspace.