Sha1-Hulud worm spread across npm packages

Sha1-Hulud "The Second Coming" was a broad npm worm wave discovered on November 24, 2025. It followed the September Shai-Hulud pattern but moved faster, crossed more package scopes, and produced more public evidence of stolen credentials.

The package list quickly outgrew any single vendor story. StepSecurity tracked hundreds of affected npm packages, including major scoped groups such as @asyncapi, @posthog, @postman, @voiceflow, @accordproject, @browserbasehq, @actbase, @oku-ui, and @mcp-use. Zapier and ENS are modeled separately because their package boundaries and response evidence are cleaner.

The payload installed Bun, harvested local and CI secrets, and wrote stolen material into GitHub repositories created under compromised accounts. StepSecurity reported more than 21,000 public repositories within five hours, using the description Sha1-Hulud: The Second Coming. Persistence was explicit: the malware registered a self-hosted GitHub Actions runner named SHA1HULUD under $HOME/.dev-env, then used GitHub discussion workflow injection to keep execution available after the first package install. The destructive path mattered too. On non-CI Linux hosts the payload could shred writable files under the user's home directory, turning an install-time credential theft into a local data-loss event for some machines.

This campaign record carries the broad worm mechanics and the moving aggregate. Leaf records remain package-scoped where the affected ecosystem published official advisories or where package lists are compact enough for practical inventory work.