Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent NPM Packages Compromised

The StepSecurity blog reports that Sha1-Hulud: The Second Coming is a new variant of the Shai-Hulud NPM worm, described as a devastating supply chain attack that has compromised Zapier and ENS domains.

The incident has compromised over 70 npm packages and has driven self-propagation with the malware creating more than 16,000 public GitHub repositories bearing the description “Sha1-Hulud: The Second Coming.” The piece notes this is an evolved variant of the September 2024 campaign and that the attack farms credentials by stealing and publicly exposing them.

Immediate remediation guidance includes checking affected package versions with npm ls, auditing GitHub accounts, removing node_modules, clearing the npm cache, and rotating exposed credentials, with steps framed for both general users and StepSecurity enterprise customers. Credits for the initial disclosure are given to Charlie Eriksen and the team at Aikido Security, according to Aikido Security. According to the same post, StepSecurity Harden-Runner now protects 9,000+ open-source projects, delivering real-time CI/CD runtime security.