Supply Chain Attack “Shai-Halud” Targets 477 NPM Packages

A major supply chain attack dubbed “Shai-Halud” has targeted the JavaScript ecosystem by affecting over 477 NPM packages, according to GBhackers on Security. The campaign was first detected by security researchers who identified suspicious activity linked to CrowdStrike-related NPM packages, according to CrowdStrike. Attackers gained unauthorized access to trusted publisher accounts, allowing them to upload malicious code to hundreds of legitimate packages hosted on NPM.

Some of the compromised packages include crowdstrike-sdk, crowdstrike-client, crowdstrike-api, and several others commonly used for integrating CrowdStrike functionality into security and automation solutions, with affected versions listed in the report. Researchers found that automation tools were used to rapidly inject rogue packages, exploiting weak account protection and inadequate oversight, enabling post-installation scripts to exfiltrate environment variables and secrets.

The incident prompted rapid action from the NPM registry and security partners to identify and remove the malicious packages, notify affected publishers, and provide guidance for auditing and updating dependencies, including recommendations to review dependency lists and reset credentials where exposure may have occurred. 17 September 2025.