Unverified50% confidenceFactExact time
NPM worms (such as Shai-Hulud) propagate by compromising one package, stealing other NPM publish tokens, and then using those tokens to publish more malicious packages in a snowball-style spread.
1
Sources
50%
Confidence
Long-term
Relevance
9/21/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedShai-Hulud 攻击的核心特征是蠕虫式扩散：窃取维护者凭证后向其维护的多个包注入恶意代码，并利用窃取的更多凭证横向传播71% similarUnverifiedShai-Hulud is the codename for a class of self-propagating npm attacks, with its name taken from the giant sandworm in the Dune series67% similarUnverifiedEcosystems such as npm and PyPI have experienced supply chain attacks in which core packages were injected with malicious code or maintainer accounts were hijacked.63% similarUnverifiedThe Morris Worm spread through two methods: lateral propagation (finding other connected hosts and copying itself) and local weak-password cracking.59% similarUnverifiedThe event-stream malicious package incident in the npm ecosystem demonstrated the destructive power of dependency chain poisoning, where an attacker took over a small library and injected malicious code into downstream projects.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/938227API
curl https://kongchang.com/api/v1/knowledge/claims/938227MCP
get_claim(id=938227)