In September 2025 a self-replicating worm tore through the npm registry. It earned the name Shai-Hulud by burrowing from one maintainer to the next: each infected developer machine surrendered its credentials, and the worm used those credentials to republish trojanized versions of every package that maintainer controlled, extending its reach with no central command infrastructure. @nstudio/focus was one of the packages caught in this first wave. Version 20.0.4, published 2025-09-15, shipped with a weaponized package.json whose injected postinstall hook executed a bundled credential harvester the instant anyone ran npm install. The package's prior release line is clean.
Key Findings
- Malicious version: v20.0.4, published 2025-09-15 out-of-band; the prior release line is clean.
- Entry point: an injected
postinstall hook (node bundle.js) fires automatically on npm install, with no user interaction.
- Payload:
bundle.js, a large webpacked JavaScript blob (~3.6 MB) carrying the entire worm, dropped net-new into the package. Several bundle.js variants circulate across the campaign; the exact hash for this package is in the IOC table below, and the shared indicators are the worm's behavior and network endpoints.
- Capabilities: harvests credentials from cloud-metadata (IMDS) endpoints and environment variables, downloads the TruffleHog secret scanner to sweep the host for more secrets, validates stolen AWS credentials, and exfiltrates the results to an attacker-controlled endpoint.
- Worm mechanics: stolen npm tokens are used to self-republish the worm under the victim maintainer's identity, and the GitHub API is abused to spread further -- propagation without any central server.
- Detection: Script-JS.Worm.ShaiHulud, Text.Worm.ShaiHulud.
Package Background
@nstudio/focus has been part of the npm ecosystem since 2020-08-18. Supply chain attackers prize packages like this not for what they do, but for who maintains them and which registries those maintainers can publish to. Stealing a maintainer's npm token at install time is the worm's entire business model: one infected machine unlocks every package that person can publish.