A significant npm supply chain compromise, nicknamed Shai-Hulud, was disclosed in September 2025. Over 500 npm packages have been affected by this self-propagating malware. The attack utilizes credential theft and automated package publishing to spread. It exploits known vulnerabilities like postinstall scripts and CI/CD platform compromises.The malware likely began by executing a malicious bundle.js file via a postinstall script after package installation. This script then scanned for and harvested secrets using tools like TruffleHog. Stolen credentials were used to publish the malware to other repositories, turning compromised systems into new infection vectors. GitHub Actions was particularly abused for automated trojanization, a tactic seen before.The impact includes over 500 compromised packages and potential compromise of CrowdStrike's npm account. GitHub and CISA have released advisories regarding this incident. For mitigation, npm users should audit and replace compromised packages, lock dependencies using package-lock.json, and consider internal mirrors. Disabling postinstall scripts where possible is also advised. Developers should rotate exposed credentials and enforce least privilege principles in CI/CD environments.