CrowdStrike npm Packages Hit by Supply Chain Attack

On September 16, 2025, a supply chain attack compromised multiple npm packages maintained by the crowdstrike-publisher account, continuing the trend of the "Shai-Halud attack." Developers using these packages are urged to secure their credentials to prevent unauthorized code execution. The attack involved injecting a malicious script that downloads and runs TruffleHog to search for sensitive information like tokens and API keys.

Affected packages included core CrowdStrike offerings and various utility libraries, with the npm registry quickly removing the compromised versions. Organizations are advised to uninstall the affected packages, audit their environments for unauthorized activities, and rotate any exposed credentials.