Shai Hulud’s “The Second Coming”: New npm Campaign Hits Zapier, ENS, Postman

The article discusses a new wave of the Shai Hulud npm malware campaign that has compromised around 492 npm packages, affecting major projects like Zapier, ENS Domains, and Postman. This second wave, detected on November 24, 2025, follows an earlier attack from September 2025 and has resulted in the exposure of secrets from over 26,000 public GitHub repositories. The malware spreads through malicious install scripts and is designed to harvest sensitive data such as cloud credentials and API keys.

Organizations are advised to audit dependencies, rotate exposed secrets, and enhance their CI/CD security practices to mitigate risks. The timing of this attack coincides with npm's upcoming revocation of old tokens, prompting attackers to exploit vulnerabilities before stricter controls are enforced.