This page provides the complete list of npm packages impacted by the Shai-Hulud supply chain attack – Sep 2025, which involved the publication of malicious package versions containing code designed to harvest developer tokens and exfiltrate secrets.
You can use this list to identify compromised versions and take remediation actions.
For more details, please view our public blog post: “Zero-day Extensive NPM Package Compromise – Shai-Hulud Supply Chain Attack.”
Packages affected by zero-day vulnerabilities
Showing 30 of 200 • Page 1 of 7
- C
- C
- C
Embedded Malicious Code in @art-ws/common (npm)- C
- C
Embedded Malicious Code in @art-ws/config-ts (npm)- C
- C
Embedded Malicious Code in @art-ws/di (npm)- C
Embedded Malicious Code in @art-ws/di-node (npm)- C
Embedded Malicious Code in @art-ws/eslint (npm)- C
- C
- C
Embedded Malicious Code in @art-ws/openapi (npm)- C
- C
Embedded Malicious Code in @art-ws/prettier (npm)- C
Embedded Malicious Code in @art-ws/slf (npm)- C
Embedded Malicious Code in @art-ws/ssl-info (npm)- C
Embedded Malicious Code in @art-ws/web-app (npm)- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
- C
Embedded Malicious Code in @ctrl/deluge (npm)- C
- C
Embedded Malicious Code in @ctrl/magnet-link (npm)
Page 1 of 7