Bugs in Shai-Hulud: Debugging the Desert

This analysis describes the Shai Hulud npm worm campaign (Sept 14–16, 2025): attackers seeded dozens of malicious npm packages—likely using stolen NPM tokens—iteratively fixed bugs (e.g., postinstall capitalization), expanded propagation logic, and observed community spread into multiple ecosystems; the payload collects credentials and system data (GitHub/GCP/AWS/NPM), and the report provides a timeline and evidence of active seeding and propagation across packages.