{"id":"MAL-2025-47450","summary":"Malicious code in hello-shai (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (297f2a57d1c225e18d8464c2024daef4567955be0eb8cd8d45052aa778fb4f3a)\nThis package was compromised by the Shai-Hulud NPM worm. The malicious payload\nsteals tokens and credentials and publishes them to GitHub before propogating\nitself to NPM packages the user owns.\n","modified":"2025-09-18T04:34:17Z","published":"2025-09-18T04:34:17Z","database_specific":{"malicious-packages-origins":[{"import_time":"2025-09-18T04:34:27.306675Z","modified_time":"2025-09-18T04:34:17Z","sha256":"297f2a57d1c225e18d8464c2024daef4567955be0eb8cd8d45052aa778fb4f3a","source":"google-open-source-security","versions":["1.0.1"]}]},"references":[{"type":"WEB","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"type":"WEB","url":"https://semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/"},{"type":"WEB","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"type":"WEB","url":"https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised"},{"type":"WEB","url":"https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"}],"affected":[{"package":{"name":"hello-shai","ecosystem":"npm","purl":"pkg:npm/hello-shai"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hello-shai/MAL-2025-47450.json"}}],"schema_version":"1.7.3"}