Zapier’s NPM Account Hacked – Multiple Packages Infected with Malware

A massive supply chain attack targeting the NPM accounts of automation giant Zapier and the Ethereum Name Service (ENS).

Identified by Aikido Security, the campaign is being orchestrated by the same threat actors responsible for the “Shai Hulud” self-propagating worm that first surfaced in September.

This latest wave, self-titled “Shai Hulud: The Second Coming,” has compromised multiple core packages and created over 19,000 public repositories containing stolen credentials.

The threat actor behind this campaign has pivoted from previous targets to inject malicious code directly into widely used dependencies within the Zapier and ENS ecosystems.

Unlike typical static malware, this attack uses a self-propagating worm that can rapidly expand. Once a developer installs an infected package, the malware activates to harvest sensitive secrets, including NPM tokens, GitHub Personal Access Tokens (PATs), and cloud infrastructure keys.

These stolen credentials are then immediately utilized to spread the infection further, creating a cascading effect across the open-source community. The speed of this propagation is alarming, with the impact surpassing the actor’s initial September campaign within just five hours of detection.

Data Exfiltration Tactics

The primary objective of this attack appears to be maximum disruption and data exposure. The malware employs TruffleHog, a tool designed to hunt for secrets, to exfiltrate sensitive data from infected environments.

The attackers are not just keeping these credentials to themselves. They are also sharing them publicly on GitHub in repositories with descriptive titles “Shai Hulud: The Second Coming.”

This public exposure exponentially increases the risk, as it allows other opportunistic threat actors to weaponize the exposed keys before organizations can rotate them, Aikido Security said to Cybersecurity News.

The sheer volume of created repositories suggests a highly automated execution meant to overwhelm security teams and incident responders.

The following packages have been confirmed as compromised and should be considered actively malicious.

Organizations utilizing any of the listed packages must assume a full compromise of their development environments. Security teams are urged to immediately rotate all GitHub, NPM, and cloud credentials to prevent unauthorized access.

It is critical to audit all dependencies and specifically scan GitHub organizations and employee accounts for repositories matching the “Shai Hulud” description.

To halt further spread, DevOps teams should temporarily disable NPM postinstall scripts in CI/CD pipelines where possible and enforce Multi-Factor Authentication (MFA) for all package maintainers.

Locking dependency versions and utilizing tools like SafeChain can help block the automatic execution of this malware while the ecosystem recovers.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.