Guide · Supply-chain security · as of 29 October 2026
GitHub did not build an npm firewall for fun. It built it after a year in which a worm spread through the registry on its own, and a second campaign turned ordinary build pipelines into secret thieves. Here is what happened, from the researchers who tracked it. The counts differ by vendor and by wave, so treat them as scale, not a ledger, and never add the waves together.
Shai-Hulud
September 2025
In mid-September 2025, researchers found npm packages that, once installed, stole the developer’s npm token and cloud credentials, then used that token to publish the same malicious payload into other packages the victim maintained. It spread by itself, which is why it was named after the sandworm. JFrog counted 164 unique malicious packages across 338 infected versions on the first day. Aikido put the reach at more than 1,280 packages with over two billion downloads a month between them. CISA issued a formal alert on 23 September 2025.
Shai-Hulud 2.0
November 2025
A second wave in November 2025 was wider. JFrog counted roughly 796 further malicious packages across the main public registries; Unit 42 described a campaign touching more than 25,000 repositories across hundreds of accounts. The lesson of both waves: a stolen publishing token turns one compromised maintainer into hundreds of poisoned packages overnight.
GhostAction
2025 and October 2026
GhostAction did not poison packages. It injected a malicious GitHub Actions workflow into repositories, so the project’s own pipeline quietly exfiltrated its secrets on the next run. GitGuardian traced the 2025 wave to 327 users across 817 repositories, with 3,325 secrets stolen, including npm, PyPI and DockerHub tokens. It returned at far greater scale in October 2026: reporting put it at around 1,900 compromised accounts and more than 30,000 repositories, over waves on 8 to 16 October. The later wave swept the whole working tree and git history for cloud credentials, not just the Actions secrets.
Why these worked
What stops them
Every one of these attacks is blunted by the same handful of habits: hold a new version back for a cooldown, turn install scripts off, keep tokens short-lived and narrow, and route installs through a firewall that checks each package first. That is the next guide, step by step.
Sources
read 29 October 2026
A question?
Tell us how your builds pull dependencies, and we will tell you where the gaps are.