Multiple cybersecurity firms warn of a second wave of npm supply chain attacks dubbed Sha1-Hulud, which compromise packages and steal sensitive credentials. The campaign employs malicious scripts during package installation to exfiltrate secrets and potentially cause data destruction, representing an escalation in attack tactics. #Sha1Hulud #npmSupplyChain
Keypoints
- The Sha1-Hulud campaign targets the npm registry with trojanized packages uploaded between November 21-23, 2025.
- The malware executes malicious code during the preinstall phase, including secret theft and environment setup.
- The attack exploits compromised maintainer accounts to publish malicious packages and exfiltrate sensitive credentials.
- If credential theft fails, the malware resorts to destructive actions, such as wiping user home directories.
- Organizations are advised to scan endpoints, remove compromised packages, rotate credentials, and review repository workflows for anomalies.
Read More: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html