Zapier’s NPM Account Hacked – Multiple Packages Infected with Self-Propagating Shai Hulud Malware

A massive supply chain attack targeting the NPM accounts of automation giant Zapier and the Ethereum Name Service (ENS).

Identified by Aikido Security, the campaign is being orchestrated by the same threat actors responsible for the “Shai Hulud” self-propagating worm that first surfaced in September.

This latest wave, self-titled “Shai Hulud: The Second Coming,” has compromised multiple core packages and created over 19,000 public repositories containing stolen credentials.

The threat actor behind this campaign has pivoted from previous targets to inject malicious code directly into widely used dependencies within the Zapier and ENS ecosystems.

Unlike typical static malware, this attack uses a self-propagating worm that can rapidly expand. Once a developer installs an infected package, the malware activates to harvest sensitive secrets, including NPM tokens, GitHub Personal Access Tokens (PATs), and cloud infrastructure keys.

These stolen credentials are then immediately utilized to spread the infection further, creating a cascading effect across the open-source community. The speed of this propagation is alarming, with the impact surpassing the actor’s initial September campaign within just five hours of detection.

Data Exfiltration Tactics

The primary objective of this attack appears to be maximum disruption and data exposure. The malware employs TruffleHog, a tool designed to hunt for secrets, to exfiltrate sensitive data from infected environments.

The attackers are not just keeping these credentials to themselves. They are also sharing them publicly on GitHub in repositories with descriptive titles “Shai Hulud: The Second Coming.”

This public exposure exponentially increases the risk, as it allows other opportunistic threat actors to weaponize the exposed keys before organizations can rotate them, Aikido Security said to Cybersecurity News.

The sheer volume of created repositories suggests a highly automated execution meant to overwhelm security teams and incident responders.

The following packages have been confirmed as compromised and should be considered actively malicious.

Ecosystem	Package Name	Status
Zapier	zapier-platform-core	Infected / Malicious
Zapier	zapier-platform-cli	Infected / Malicious
Zapier	zapier-platform-schema	Infected / Malicious
Zapier	@zapier/secret-scrubber	Infected / Malicious
ENS	@ensdomains/ens-validation	Infected / Malicious
ENS	@ensdomains/content-hash	Infected / Malicious
ENS	ethereum-ens	Infected / Malicious
ENS	@ensdomains/react-ens-address	Infected / Malicious
ENS	@ensdomains/ens-contracts	Infected / Malicious
ENS	@ensdomains/ensjs	Infected / Malicious
ENS	@ensdomains/ens-archived-contracts	Infected / Malicious
ENS	@ensdomains/dnssecoraclejs	Infected / Malicious

Organizations utilizing any of the listed packages must assume a full compromise of their development environments. Security teams are urged to immediately rotate all GitHub, NPM, and cloud credentials to prevent unauthorized access.

It is critical to audit all dependencies and specifically scan GitHub organizations and employee accounts for repositories matching the “Shai Hulud” description.

To halt further spread, DevOps teams should temporarily disable NPM postinstall scripts in CI/CD pipelines where possible and enforce Multi-Factor Authentication (MFA) for all package maintainers.

Locking dependency versions and utilizing tools like SafeChain can help block the automatic execution of this malware while the ecosystem recovers.

Indicator Type	Value / Description
Repo Name Pattern	Shai Hulud: The Second Coming
Malware Behavior	Automated execution of TruffleHog for secret scanning
Targeted Assets	NPM Tokens, GitHub PATs, Cloud Keys
Public Repo Count	> 19,000 malicious repositories created

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.