In September 2025, npm packages began updating themselves without any human involvement, publishing new versions that spread malicious code across the software supply chain. The worm, dubbed Shai-Hulud after the creature from Frank Herbert's Dune series, altered more than 500 package versions between September 14 and 18, stealing credentials and republishing itself autonomously. By November, a larger variant had backdoored 796 packages, and the latest iteration, ChainDrop, compromised over 400 packages in under four hours this August by exploiting cryptographically signed pipelines that were supposed to prevent tampering.

The attack strategy is straightforward but devastating. A compromised npm package runs a postinstall script that scans the infected machine for credentials, including npm and GitHub tokens, AWS or GCP secrets, and cloud metadata. It downloads Trufflehog, a legitimate open-source secret-scanning tool, to verify any credentials it finds. When it locates a GitHub token, it exfiltrates everything to a new public repository and makes any private repos public as well, republishing them with a "-migration" suffix. If it finds an npm token, it calls the registry's API to list every package the compromised developer maintains, downloads them, injects itself into the postinstall step, bumps the version number, and republishes them. The spring 2026 variant, Mini Shai-Hulud, evolved to specifically target credentials belonging to Claude, Codex, Cursor, and Gemini, concluding that AI coding tools are involved in the most interesting projects. ChainDrop went further by parking its command infrastructure inside an Ethereum smart contract, making domain blocklists useless, and by riding legitimate, cryptographically signed release pipelines that granted each poisoned version a valid SLSA provenance attestation.

The report argues that the fundamental assumption underlying package managers has collapsed: "If publishing can now be automated by non-human agents already in the environment, it is no longer safe at all." Palo Alto Networks' Unit 42 is moderately confident the malicious script was partly written by an LLM, based on stylistic tells such as code comments and emoji embedded in the payload. The worm doesn't need to convince anyone of anything—it simply needs one compromised credential and an install script, after which the registry confers trust and credibility. According to the report, "Attestation tells us where a package came from; it doesn't say anything about whether the commit should exist at all." ChainDrop didn't forge a signature; it compromised a maintainer account with legitimate write access and let that account's legitimate, signed pipeline build and publish the malware on its behalf.

The vulnerability isn't specific to npm. A Terraform provider pulled from a public registry is code that a publisher's account was trusted to ship, running with whatever access the machine that requested it holds. A CI runner with a standing cloud credential and an open path to the internet is the same target as a maintainer's laptop with a valid npm token: one a worm can compromise once and then use to spread itself to everything downstream, at whatever speed automation allows. The report recommends pinning every dependency to an immutable reference, routing providers and modules through a private, versioned, allow-listed registry that your organization curates, and scoping credentials to the deployment rather than the developer or runner. Short-lived, per-deployment credentials issued through OIDC mean there's no standing secret for a scanning pass to find. Restricting a runner's egress to only the handful of domains a deployment actually needs means any attempt to phone home runs straight into a firewall before it ever leaves the building.

The report's bottom line is stark: software supply chains don't just get compromised anymore—they get infected, and infections spread. Shai-Hulud figured out how to weaponize build pipelines within its first 24 hours, and the industry has been scrambling to catch up through progressively more painful installments paid every couple of months. The worm that started as a credential thief has now learned to forge the very cryptographic proof meant to catch it, and its latest prey is the AI tooling teams use to speed up production. An unpinned reference and open registry pull are all it would take for this to spread to Terraform providers and modules, and by the time you notice the next worm, it'll have already spread to everything downstream of the one reference you forgot to pin. Pipeline security was once treated as plumbing, but plumbing turns out to be a perfect avenue for worms to reach the keys protecting your secrets—and the industry's hard-won lesson is that build infrastructure isn't a convenience layer but production infrastructure wielding more standing privileges than the systems it deploys. Organizations that rely on public registries and long-lived credentials are betting their security posture on every maintainer's hygiene rather than their own controls, a wager that becomes harder to justify each time the interval between variants shortens.