In September 2025, a supply-chain attack dubbed Shai-Hulud tore through npm, the package registry most JavaScript projects depend on. It compromised popular packages and spread to more than 180 packages across dozens of maintainer accounts.
What made it nasty was how it moved. On install, the malicious code scraped credentials from the developer's machine, npm tokens, GitHub tokens, and cloud keys, then used those stolen npm tokens to publish poisoned versions of other packages owned by the same maintainer. It also dumped harvested secrets into public repositories.
For a small or mid-size business, you likely don't publish packages, but your website or app almost certainly pulls in npm code somewhere. The practical response: ask whoever maintains your software to pin dependency versions rather than auto-updating, rotate any tokens or API keys that touch your build, and confirm your team isn't blindly installing the newest release of everything. Boring hygiene, but it's what blunts attacks like this.
Further reading: original source ↗
Want this handled for you?
This is exactly the kind of thing our website security work takes off your plate. Start with a free, no-pressure look at your site.
Come aboard