# Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack

DevFeed: [Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack](<https://devfeed.tech/articles/zero-day-extensive-npm-package-compromise-shai-hulud-supply-chain-attack-7902.md>)

Original publisher: [Read original article](<https://snyk.io/blog/embedded-malicious-code-in-tinycolor-and-ngx-bootstrap-releases-on-npm/>)

Author: Brian Clark

Published: 2025-09-15T11:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [Bootstrap](<https://devfeed.tech/topics/bootstrap.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Security](<https://devfeed.tech/topics/security.md>), [data](<https://devfeed.tech/topics/data.md>), [Front end](<https://devfeed.tech/topics/frontend.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [angular](<https://devfeed.tech/tags/angular.md>), [api-keys](<https://devfeed.tech/tags/api-keys.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [package-compromise](<https://devfeed.tech/tags/package-compromise.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [shai-hulud](<https://devfeed.tech/tags/shai-hulud.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [worm](<https://devfeed.tech/tags/worm.md>)

## AI overview

This article reports the Shai-Hulud supply chain attack, in which malicious versions of ngx-bootstrap and other npm packages embedded malware to harvest developer tokens, cloud credentials, API keys, and other secrets. The malware exfiltrated data through webhooks and public GitHub repositories, targeted CI/CD environments through GitHub Actions, and spread across hundreds of compromised packages. The article recommends treating affected systems as compromised, removing the packages, rotating secrets from a trusted machine, and investigating for lateral movement.

## Source excerpt

A supply chain attack hit the ngx-bootstrap npm package, embedding malware to steal developer credentials. See affected versions (e.g., 20.0.4-6, 19.0.3) and our playbook to contain the threat and rotate compromised secrets.