The npm attacks of September 2025: when the building blocks of websites are poisoned

In September 2025, popular JavaScript packages used by millions of websites were published with malicious code, then a worm called Shai-Hulud spread across hundreds of packages. What it means for your website.

Modern websites are built with thousands of small open-source building blocks, called packages, downloaded from the npm registry. In September 2025, two attacks showed how fragile that chain can be.

First attack: a maintainer phished

• Around 8 September, a well-known maintainer received an email that looked like it came from npm support, sent from the lookalike domain npmjs.help.
• A fake page captured his login details, including his two-factor code.
• The attackers published malicious versions of 18 very popular packages, including chalk and debug.
• The injected code aimed to swap cryptocurrency wallet addresses in the browser, to divert payments.

Second attack: the Shai-Hulud worm

From 15 September, a self-spreading malware nicknamed Shai-Hulud stole developers’ npm tokens and cloud credentials, then used them to publish infected versions of other packages they maintained. GitHub removed more than 500 compromised packages.

What it means for your website

• Lock dependency versions with a lockfile, so an update is never installed without you knowing.
• Do not rush to install a new version on the day it is published: give the community time to spot a problem.
• Use phishing-resistant authentication, such as passkeys or security keys, on developer accounts.
• Keep secrets out of development machines and rotate them after any incident.

A shared responsibility

No team can rewrite every package it uses. But it can choose its dependencies carefully, limit how many it adds, and keep an eye on security alerts. That discipline is part of building a serious website.

A website is only as safe as the code it borrows.

Sources: BleepingComputer, AWS Security Blog, Pulsedive, September 2025.

Want a website built with maintained, reviewed dependencies? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.