NewsPublished 24 Nov 2025

Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft

Source Reddit InfoSec News

Description

The 'Second Sha1-Hulud Wave' is a high-severity supply chain attack targeting over 25,000 npm repositories by exploiting the npm preinstall script mechanism to steal credentials. This attack leverages malicious code injected into the preinstall phase of npm packages, allowing threat actors to exfiltrate sensitive authentication tokens or credentials during package installation. The widespread impact on repositories indicates a significant risk to software supply chains, particularly for organizations relying heavily on npm packages. European organizations using npm in development or production environments could face confidentiality breaches, unauthorized access, and potential downstream compromise. Mitigation requires rigorous auditing of npm dependencies, restricting preinstall script execution, and implementing strict credential management policies. Countries with strong software development sectors and high npm usage, such as Germany, the UK, France, and the Netherlands, are most at risk. Given the ease of exploitation and broad scope without requiring user interaction, the suggested severity is high. Defenders should prioritize supply chain security controls and continuous monitoring to detect anomalous preinstall behaviors.

Impact

For European organizations, the impact of this threat is significant due to the heavy reliance on npm packages in software development and production environments. Credential theft can lead to unauthorized access to internal systems, cloud services, and developer accounts, potentially resulting in data breaches, intellectual property theft, and further lateral movement within networks. Compromised credentials may also enable attackers to inject malicious code into downstream applications, amplifying the attack's reach. The disruption of development pipelines and loss of trust in software supply chains can cause operational delays and financial losses. Organizations in sectors with stringent data protection regulations, such as finance, healthcare, and critical infrastructure, face heightened risks of regulatory penalties and reputational damage. The attack's automated nature and broad scope increase the likelihood of widespread exposure across European enterprises, especially those with extensive npm usage and complex dependency trees.

Defensive guidance

To mitigate this threat, European organizations should implement several targeted measures beyond generic advice: 1) Enforce strict auditing and vetting of npm dependencies, focusing on those with preinstall scripts or recent changes. 2) Use tools that can analyze and block suspicious lifecycle scripts during package installation, such as npm audit enhancements or third-party supply chain security platforms. 3) Restrict the execution of preinstall scripts in controlled environments or CI/CD pipelines where feasible. 4) Employ environment segmentation and least privilege principles to limit the scope of credentials accessible during npm installs. 5) Rotate and minimize the use of static credentials and tokens in development environments, replacing them with ephemeral or scoped tokens. 6) Monitor network traffic and logs for unusual outbound connections or data exfiltration attempts during package installations. 7) Educate developers and DevOps teams about supply chain risks and encourage reporting of suspicious package behavior. 8) Maintain up-to-date backups and incident response plans tailored to supply chain compromise scenarios.

Summary

The 'Second Sha1-Hulud Wave' represents a sophisticated supply chain attack targeting the npm ecosystem, affecting over 25,000 repositories. Attackers exploit the npm preinstall lifecycle script, which runs automatically during package installation, to execute malicious code that steals credentials such as tokens or passwords from the environment or configuration files. This method allows attackers to silently exfiltrate sensitive information without requiring direct user interaction or elevated privileges beyond those granted during npm install. The attack capitalizes on the trust developers place in npm packages and the automated nature of dependency installation. Although no specific affected versions or patches are listed, the scale of affected repositories suggests widespread compromise of popular or transitive dependencies. The lack of known exploits in the wild may indicate early detection or limited active exploitation, but the high severity rating underscores the potential impact. The attack threatens confidentiality by exposing credentials, integrity by potentially allowing unauthorized code execution, and availability if attackers leverage stolen credentials to disrupt services. The technical details highlight the attack's discovery through infosec community channels, emphasizing the importance of community vigilance in supply chain security.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Nov 2025, 14:12 UTC

Technical details

References

Community reviews

Related threats