Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading

In mid-September 2025, security researchers first identified a supply-chain compromise in the npm ecosystem, the original Shai-Hulud campaign. The first known compromised package was @ctrl/tinycolor version 4.1.1. Only two months later, a far more aggressive and automated wave appeared: Shai-Hulud 2.0. The second wave of the Shai-Hulud campaign demonstrates an unprecedented level of automation and propagation speed, compromising hundreds of npm packages within hours. By chaining credential theft, self-replication, and automated republishing, the malware achieved rapid ecosystem-wide spread unlike anything previously observed in npm package supply…