It was Monday morning, November 24th, 2025. Charlie, a security researcher, sat down with his coffee and saw a cascade of alerts. "Yikes, surely that's a false positive?" he thought. It wasn't. Within hours, over 640 npm packages with 132 million monthly downloads were compromised. Major organizations like Zapier, PostHog, Postman, AsyncAPI, and ENS Domains fell victim to what security researchers are calling the most sophisticated supply chain attack of 2025.
This wasn't just another breach.
Shai-Hulud 2.0, named after the sandworms in Frank Herbert's Dune, represents a fundamental shift in software supply chain threats. Unlike traditional malware that simply infects systems, this is a true worm: self-replicating, autonomous, and devastatingly effective. The attack created over 25,000 malicious GitHub repositories, with 1,000 new repos appearing every 30 minutes at its peak.
The evolution timeline tells the story:
August 2025: The S1ngularity attack targeted Nx packages
September 2025: The first Shai-Hulud wave compromised 180+ packages and stole $50 million in cryptocurrency
November 21-24, 2025: "The Second Coming" struck with unprecedented scale and sophistication
What makes this attack terrifying isn't just its scale. It's the intelligence behind it. The worm can now infect up to 100 npm packages per victim (compared to 20 in September), includes a persistent backdoor via self-hosted GitHub Actions runners, and if it can't propagate, it wipes the victim's home directory entirely.
As Florian Roth, Head of Research at Nextron Systems, observed: "We used to fight worms on the OS level. Slammer, Blaster, Conficker... Now we get the same behaviour one layer up, inside the software ecosystems we trust every day."
The technical sophistication of Shai-Hulud 2.0 is remarkable. Researchers have documented how the attack uses a two-stage payload: setup_bun.js installs the Bun runtime (an intentional evasion technique since most security tools monitor Node.js, not Bun), then executes bun_environment.js, a heavily obfuscated 10MB payload.
The critical innovation here is preinstall execution. Unlike previous attacks that ran after installation, this malware executes during the preinstall phase before dependencies even resolve. This dramatically expands the attack surface across developer machines and CI/CD pipelines.
Once active, the malware:
Scans for credentials using TruffleHog (a legitimate security tool, weaponized)
Harvests GitHub tokens, npm tokens, AWS, GCP, and Azure credentials
Exfiltrates data to GitHub repositories with the description "Sha1-Hulud: The Second Coming"
Enumerates all packages the victim can publish
Automatically injects malicious code and republishes up to 100 packages
Installs persistent backdoors via GitHub Actions runners
Each victim becomes Patient Zero for the next wave. As Snyk documented, this creates a network effect where compromised accounts provide access to dozens or hundreds of other accounts, significantly extending the malware's operational lifetime.
The Shai-Hulud attack exposes an uncomfortable reality: your IDE is now your most vulnerable perimeter.
Traditional security (firewalls, EDR, SIEM systems) focuses on production environments. Cloud security has matured with CSPM and CWPP solutions. But developer environments? Wide open. As CISA noted in their official alert, this represents a fundamental blindspot in enterprise security architecture.
The numbers are staggering. Wiz's analysis showed that compromised packages like @postman/tunnel-agent exist in 27% of cloud environments, while posthog-node appears in 25%. When AsyncAPI's packages were trojaned, they affected roughly 20% of scanned environments.
Why did traditional defenses fail?
Trust-based ecosystem: npm relies on maintainer reputation
Automated workflows: npm install runs without scrutiny in CI/CD
No visibility: Package managers operate in a security blindspot
Preinstall execution: Malware runs before installation completes. No sandbox, no isolation
The timing was strategic too. Attackers struck just before npm's December 9th deadline to revoke classic tokens, exploiting the window where many developers hadn't migrated to trusted publishing. Combined with the Thanksgiving weekend in the US, when security teams were understaffed, the attack achieved maximum impact with minimal detection.
The Shai-Hulud attacks prove that the npm install trust model is fundamentally broken. According to CrowdStrike's analysis, package ecosystems have become execution surfaces that "nobody monitors, nobody hardens, and attackers don't even need an exploit to make them go wild."
Immediate actions are clear: search GitHub for "Sha1-Hulud: The Second Coming" repositories, roll back to pre-November 21 package versions, rotate all credentials, and audit for unauthorized GitHub Actions workflows. But these are reactive measures.
The real solution requires shifting security all the way left, into the IDE itself. Traditional approaches scan production deployments after packages are installed. By then, it's too late. Preinstall scripts have already been executed, credentials have been harvested, and the worm has propagated.
This is why we built Kirin.
Kirin integrates directly into IDEs like Cursor, scanning packages in real-time before installation. It detects malicious patterns like suspicious preinstall scripts, obfuscated payloads, unauthorized network calls, and credential scanning tools, and blocks them at the point of entry. If Shai-Hulud can't execute at install time, it can't propagate.
The attack surface has shifted. Worms are back, but now they're living in our package managers. The open source ecosystem that powers modern development needs defenders at every layer, especially at the layer developers interact with most: their IDE.
After Shai-Hulud compromised 800+ packages in one weekend, exposed 25,000+ repositories, and affected 132 million monthly downloads, the question isn't whether your development environment will be targeted. The question is whether you'll be ready when it happens.
Your IDE is either protected, or it's compromised.
Learn how Kirin provides real-time protection against supply chain attacks at the IDE level. Because by the time malicious code reaches production, you've already lost.
If this attack caught your attention, you’ll want to read our latest deep dive: MCP Hijacking of Cursor’s New Browser, a look at how extension-level attacks are evolving beyond NPM. And if you’re ready to protect your team before the next wave hits, start today at GetKirin.com.