zapier-npm
Zapier NPM Account Compromise (Shai Hulud V2)
The Sha1-Hulud "Second Coming" npm worm compromised Zapier packages across the @zapier scope and unscoped zapier-platform packages. Affected releases used a preinstall hook to invoke Bun and run an obfuscated credential stealer that harvested GitHub, npm, cloud, and local environment secrets, exfiltrated them through public GitHub repositories, attempted npm self-propagation, and registered a self-hosted GitHub Actions runner for persistence. The incident affected core Zapier platform and SDK packages.
- Date
- 2025-11-23 to 2025-11-24
- Category
- Open Source
- Target Surface
- Package registry
- Insertion Phase
- distribution
- Impact
- Credential theft
- Cause
- Compromised Account/Credentials
What Was Affected
Package
zapier-npm
LanguageJavaScript
ComponentLibrary
Artifact typesource archive
Domain typepackage host
Domain
npmjs.com
Repository
github.com/zapier/zapier-platform
Compromised Versions
- @zapier/ai-actions@0.1.18
- @zapier/ai-actions@0.1.19
- @zapier/ai-actions@0.1.20
- @zapier/ai-actions-react@0.1.12
- @zapier/ai-actions-react@0.1.13
- @zapier/ai-actions-react@0.1.14
- @zapier/babel-preset-zapier@6.4.1
- @zapier/babel-preset-zapier@6.4.2
- @zapier/babel-preset-zapier@6.4.3
- @zapier/browserslist-config-zapier@1.0.3
- @zapier/browserslist-config-zapier@1.0.4
- @zapier/browserslist-config-zapier@1.0.5
- @zapier/eslint-plugin-zapier@11.0.3
- @zapier/eslint-plugin-zapier@11.0.4
- @zapier/eslint-plugin-zapier@11.0.5
- @zapier/mcp-integration@3.0.1
- @zapier/mcp-integration@3.0.2
- @zapier/mcp-integration@3.0.3
- @zapier/secret-scrubber@1.1.3
- @zapier/secret-scrubber@1.1.4
- @zapier/secret-scrubber@1.1.5
- @zapier/spectral-api-ruleset@1.9.1
- @zapier/spectral-api-ruleset@1.9.2
- @zapier/spectral-api-ruleset@1.9.3
- @zapier/stubtree@0.1.2
- @zapier/stubtree@0.1.3
- @zapier/stubtree@0.1.4
- @zapier/zapier-sdk@0.15.5
- @zapier/zapier-sdk@0.15.6
- @zapier/zapier-sdk@0.15.7
- zapier-async-storage@1.0.1
- zapier-async-storage@1.0.2
- zapier-async-storage@1.0.3
- zapier-platform-cli@18.0.2
- zapier-platform-cli@18.0.3
- zapier-platform-cli@18.0.4
- zapier-platform-core@18.0.2
- zapier-platform-core@18.0.3
- zapier-platform-core@18.0.4
- zapier-platform-legacy-scripting-runner@4.0.2
- zapier-platform-legacy-scripting-runner@4.0.3
- zapier-platform-legacy-scripting-runner@4.0.4
- zapier-platform-schema@18.0.2
- zapier-platform-schema@18.0.3
- zapier-platform-schema@18.0.4
- zapier-scripts@7.8.3
- zapier-scripts@7.8.4
Incident Context
- Motive
- Credential Theft
- Attribution
- Third Party
- Transitive
- No
- User Impact
- 0
- Observed Duration
- 1 days
External References
- docs.zapier.com/integrations/build-cli/inc-547
- cybersecuritynews.com/zapiers-npm-account-compromised
- stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
- stepsecurity-public-media.s3.us-west-2.amazonaws.com/website/blog/Sha1-Hulud-The-Second-Coming.html
Source Data
Source record: oss/zapier-npm/meta.yaml