In late 2025 a piece of malware named after the giant sand-worms in Dune started quietly chewing through the plumbing of the modern internet and by the time researchers gave it a proper name, it had already infected hundreds of code packages and thousands of developer repositories. As of May 2026 it is still going, with a fresh wave hitting signed TanStack and Mistral packages just this week.
If you are new to cybersecurity, the words "npm package" and "supply chain attack" probably feel like someone else's problem. They are not. This article walks you through what actually happened, why it matters even if you have never written a line of code, and what the takeaways are for people who just use apps.
A two minute primer on software supply chains
Almost no app you use is built from scratch. The team that made your banking app, your favorite mobile game, or the SaaS tool your company runs on all reach for ready made building blocks. These blocks are called packages or libraries. They handle things like sending an email, parsing a date, or making a button look nice.
For JavaScript, which runs most of the web, those blocks live on a public registry called npm. There are over three million packages on it. A typical modern app pulls in hundreds of them, and each of those pulls in more, which pull in more. The result is a giant invisible tree of trust.
If an attacker can poison just one popular package somewhere in that tree, every app that depends on it inherits the poison. That is a software supply chain attack.
A flat info-graphic showing one infected developer laptop sending a poisoned package through a central registry out to many downstream apps, with a single bright red node marking the source of infection.
What makes Shai-Hulud different
Most supply chain attacks before this one worked like a hit and run. The attacker would compromise a package, ship malware, get caught within a few days, and the package would be cleaned up. Painful, but contained.
Shai-Hulud is a worm. That is the part that scared people. A worm is malware that copies itself without help. Once Shai-Hulud lands inside a developer's machine through one infected package, it does the following on its own, according to writeups from Sonatype, ReversingLabs, and Mondoo:
- It steals the developer's saved credentials, including their npm access token, GitHub token, and any cloud keys lying around.
- It uses those tokens to publish new infected versions of every other package that developer maintains.
- It posts the stolen secrets into newly created public GitHub repositories so the attacker can collect them.
- Anyone who installs one of those newly poisoned packages becomes the next host, and the cycle restarts.
The Mondoo writeup pegged the November 2025 wave at 796 compromised packages and roughly 25,000 affected repositories. The May 2026 wave reported by Bleeping Computer hit packages signed with valid publisher credentials, which made the malicious versions look completely legitimate to standard checks.
Why this matters if you do not write code
Three reasons, in order of how directly it can hit you.
Apps you already use depend on these packages. A poisoned package buried inside a SaaS product you log into can leak data, plant back doors, or be used as a stepping stone into the company's internal systems. You will rarely hear about your specific exposure unless it ends up in a breach notification months later.
Your data ends up in the loot pile. Attackers behind these campaigns are mostly hunting for credentials and crypto keys. Once those keys are stolen, they get sold or used to pivot into other systems. That includes the cloud accounts that hold your data.
Trust in updates erodes. The whole reason updates exist is to make you safer. When updates themselves become a delivery vehicle for malware, the natural reaction is to delay updating. That is the worst possible outcome, because it leaves you exposed to old, well known bugs the attackers also know about.
How attackers usually get the first foothold
Worth understanding because the techniques are the same ones that target individuals.
- Phishing emails to package maintainers. A fake "your npm account needs to be re verified" email lands in a developer's inbox. They click, log into a fake page, and hand over the keys. The Axios npm compromise in March 2026 started exactly this way.
- Stolen session tokens from a developer's own machine. This is where things like ClickFix and infostealers come in. A maintainer gets infected, and the attacker pulls the npm token straight out of the laptop without ever needing the password.
- Typosquatting. Attackers publish packages with names one letter off from popular ones, hoping a developer mistypes during install.
If you read the companion article on ClickFix attacks, you can probably see the pattern. The same human level tricks that hit a regular user can hit a developer who maintains a package that millions of apps depend on. That is how a phishing email can quietly become a global incident.
What is being done about it
A few things, with mixed results so far.
- Mandatory two factor authentication on package registries. npm now requires 2FA for high impact maintainers. Most other registries are following.
- Provenance and signing. Packages can now be cryptographically signed so you can verify who built them. Shai-Hulud's May 2026 wave showed the limits of this when the signing keys themselves get stolen.
- Software bills of materials. Companies are starting to publish SBOMs, which list every package inside their product. The CISA SBOM resource is the plain language version of why this matters.
- Better scanning at install time. Tools like Socket and Snyk check packages for malicious behaviour before they reach the developer's machine.
None of these are silver bullets. The honest answer is that the ecosystem is in a slow arms race, and attackers are not running out of ideas.
What you can actually do as a beginner
You do not need to install scanning tools or audit dependency trees. A short list, ranked by impact:
- Update your apps and your operating system promptly. Most of the time the update fixes the kind of bugs supply chain malware looks for.
- Use a password manager and unique passwords. When a SaaS provider gets hit through their supply chain, your reused password is what turns one breach into ten.
- Turn on multi factor authentication everywhere it is offered. CISA has a clean explainer if you want the beginner version.
- Be skeptical of unexpected security emails asking you to "re verify" anything. That is the same trick that gets developers, and it works on everyone the same way.
- If you do work in tech, treat your machine like the high value target it is. Rotate tokens. Do not store unencrypted credentials in your shell history. Use scoped tokens with the shortest useful lifetime.
The takeaway
Shai-Hulud is a useful story for beginners because it shows how connected modern software actually is. A single phished developer in one country can plant malware that lands inside an app a stranger opens on their phone in another country a week later. There is no clear edge between "their problem" and "my problem" anymore.
The fix is not paranoia. It is the boring stuff. Update on time. Use a password manager. Turn on MFA. Slow down before pasting anything anywhere. The sandworm is big, but it eats people who stand still.
