Open Source · 2025-11-23 to 2025-11-24 · 1 day

ENS npm packages hit by Shai-Hulud

The Sha1-Hulud "Second Coming" npm worm compromised many Ethereum Name Service packages, including @ensdomains/ensjs, @ensdomains/ens-contracts, @ensdomains/ens-validation, ethereum-ens, and supporting ENS libraries.

Part of Sha1-Hulud worm spread across npm packages campaign

ENS was one of the largest package groups in the Sha1-Hulud "Second Coming" npm wave. The compromised scope included core ENS packages, support libraries, CCIP-read components, DNSSEC tooling, and the legacy ethereum-ens package.

The attack used the same basic shape as the broader Shai-Hulud family: compromised npm publishing access, malicious package releases, credential theft, and self-propagation through stolen tokens. ENS is modeled separately because the affected package set is large enough to matter on its own.

The impact was developer-side, not a direct compromise of ENS smart contracts. Affected packages could run during installation or use in build environments, putting npm tokens, GitHub tokens, and other developer credentials at risk.

This record keeps the package list explicit so downstream analysis can answer which ENS artifacts were affected. The campaign record holds the cross-package story; this attack records the ENS trust boundary and artifact scope.

Appendix · Affected releases

@ensdomains/address-encoder npm

1.1.5

@ensdomains/blacklist npm

1.0.1

@ensdomains/buffer npm

0.1.2

@ensdomains/ccip-read-cf-worker npm

0.0.4

@ensdomains/ccip-read-dns-gateway npm

0.1.1

@ensdomains/ccip-read-router npm

0.0.7

@ensdomains/ccip-read-worker-viem npm

0.0.4

@ensdomains/content-hash npm

3.0.1

@ensdomains/curvearithmetics npm

1.0.1

@ensdomains/cypress-metamask npm

1.2.1

@ensdomains/dnsprovejs npm

0.5.3

@ensdomains/dnssec-oracle-anchors npm

0.0.2

@ensdomains/dnssecoraclejs npm

0.2.9

@ensdomains/durin npm

0.1.2

@ensdomains/durin-middleware npm

0.0.2

@ensdomains/ens-archived-contracts npm

0.0.3

@ensdomains/ens-avatar npm

1.0.4

@ensdomains/ens-contracts npm

1.6.1

@ensdomains/ens-test-env npm

1.0.2

@ensdomains/ens-validation npm

0.1.1

@ensdomains/ensjs npm

4.0.3

@ensdomains/ensjs-react npm

0.0.5

@ensdomains/eth-ens-namehash npm

2.0.16

@ensdomains/hackathon-registrar npm

1.0.5

@ensdomains/hardhat-chai-matchers-viem npm

0.1.15

@ensdomains/hardhat-toolbox-viem-extended npm

0.0.6

@ensdomains/mock npm

2.1.52

@ensdomains/name-wrapper npm

1.0.1

@ensdomains/offchain-resolver-contracts npm

0.2.2

@ensdomains/op-resolver-contracts npm

0.0.2

@ensdomains/react-ens-address npm

0.0.32

@ensdomains/renewal npm

0.0.13

@ensdomains/reverse-records npm

1.0.1

@ensdomains/server-analytics npm

0.0.2

@ensdomains/solsha1 npm

0.0.4

@ensdomains/subdomain-registrar npm

0.2.4

@ensdomains/test-utils npm

1.3.1

@ensdomains/thorin npm

0.6.51

@ensdomains/ui npm

3.4.6

@ensdomains/unicode-confusables npm

0.1.1

@ensdomains/unruggable-gateways npm

0.0.3

@ensdomains/vite-plugin-i18next-loader npm

4.0.4

@ensdomains/web3modal npm

1.10.2

ethereum-ens npm

0.8.1

Indicators

file_sha256bun_environment.js 62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0
file_sha256bun_environment.js f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068
file_sha256bun_environment.js cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd
file_sha256setup_bun.js a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

References

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack - Unit 42unit42.paloaltonetworks.com
Zapier's npm account compromised in Sha1-Hulud attackcybersecuritynews.com
Sha1-Hulud - The Second Coming - Zapier, ENS Domains, and Other Prominent NPM Packages Compromisedstepsecurity.io
Sha1-Hulud - The Second Coming archived package liststepsecurity-public-media.s3.us-west-2.amazonaws.com

Source record: oss/attacks/ensdomains-npm/meta.yaml

§Appendix · Affected releases

§Indicators

§References

Appendix · Affected releases

Indicators

References