CISA issues alert on NPM supply chain compromise involving credential theft and malware

A software supply chain compromise affecting the Network Performance Monitor (NPM) ecosystem was reported by security company Socket on September 15, 2025, involving a self-propagating malware strain known as Shai-Hulud. To date, over 500 packages have been impacted, with the campaign expanding to include repositories managed by CrowdStrike. This event demonstrates vulnerabilities in common software packaging and development practices within NPM.

The affected components include the NPM package registry and Command-Line Interface (CLI) used by Node.js developers to manage JavaScript packages. The incident initiated through a credential harvesting attack triggered by malicious postinstall scripts executing a bundle.js file, which scanned for exposed secrets and utilized the TruffleHog tool to extract credentials stored as environment variables or used by Continuous Integration and Continuous Deployment (CI/CD) platforms like GitHub Actions, GitLab Continuous Integration (CI), and Jenkins. The malware leveraged the stolen credentials to auto-publish compromised packages to other repositories, propagating the infection. Specifically, the abuse of postinstall scripts and CI/CD workflow automation, such as GitHub Actions, facilitated the rapid spread. These methods replicate attack patterns observed in the Nx package compromise in August 2025 and the 2018 event-stream incident.

The compromise has resulted in the confirmed infection of over 500 NPM packages by Shai-Hulud malware. A continuously updated list of affected packages is maintained by Socket. Users of CrowdStrike's products are advised to examine their NPM dependencies, as the NPM account for CrowdStrike's package publication is reported to be compromised.

In response, GitHub published an advisory outlining forthcoming security enhancements to its package management systems. The Cybersecurity and Infrastructure Security Agency (CISA) also issued a security advisory addressing the situation. Recommended remediation actions for NPM users include auditing and removing compromised package versions, employing dependency locking mechanisms such as package-lock.json or NPM shrinkwrap to prevent executing installation scripts during audits, employing internal package mirrors with central approval workflows, and disabling postinstall script execution where possible. For developers, immediate revocation and rotation of exposed CI/CD credentials are advised, alongside enforcing least privilege access controls and environment isolation to limit credential exposure during build and publishing processes.

This document was authored by Christopher Cullen and reflects information available as of the last update on October 23, 2025. It highlights explicit technical details without added interpretation and summarizes current recommended solutions as stated by involved entities.