As cited
Copy frozen at (site build).
threat intel
Happy Birthday, Shai-Hulud
One year after a self-propagating worm called Shai-Hulud compromised the npm package @ctrl/tinycolor in September 2025, the supply chain threat evolved into a widespread campaign that spawned multiple variants, copied code, and copycat attacks. The worm harvested credentials and GitHub tokens to inject itself into hundreds of packages, with subsequent waves in November 2025 and throughout 2026 expanding the attack surface and payload capabilities. Australian authorities arrested two alleged members of the cybercriminal group TeamPCP in August 2026 for their role in later waves, though the original authors remain unattributed and the now-public code continues to be adopted by other threat actors.
Why it matters: Developers and DevOps teams using npm packages, especially open source maintainers, face ongoing risk from supply chain compromise as the Shai-Hulud worm code remains public and widely forked; organizations need to rotate credentials, audit lockfiles, and monitor for additional waves.
- Source published
- First seen by Cybersecurity Tracker