Tag: token-stealing

1 Attack Reports | 0 Vulnerabilities

Attack reports

Self-replicating Shai-hulud worm spreads token stealing malware on npm

A self-replicating worm named Shai-hulud has been detected on the npm registry, spreading through compromised developer accounts and injecting malicious code into legitimate packages. The worm steals cloud service tokens, primarily targeting npm, GitHub, AWS, and GCP. It also installs Trufflehog to…
supply-chain
worm
npm
open-source
2025-09-16
self-replicating
shai-hulud
package-compromise
token-stealing
Published: September 16, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports