The Npm Worm Outbreak

For the first time, the world’s biggest open-source ecosystem saw a worm that spread on its own.

No botnet. No manual upload. Just automation - and trust - turned against developers.

When a maintainer got phished, Shai Hulud stole credentials, hijacked tokens, and created new CI/CD workflows to keep spreading automatically.

It didn’t stop at npm. It reached into GitHub and the cloud - exfiltrating secrets across environments.

Hosts Rob Maas (Field CTO, ON2IT) and Juri Wit (SOC Analyst, ON2IT) break down how the first self-replicating supply-chain worm worked - and what it means for every team building in the open.