corpus.blog
41554 blogs · 4,504,310 posts Claim your blog
Record · corpus.blog/posts/01a0d4a5-d702-7110-a43f-5819cf343f47

"Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26)

Unit 42 · published 25 November 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture
15blogs citing
First cited
2 Oct 2025
Most recent
29 Sept 2026
Rank this month
not ranked
Links from this post
21
Words captured
2,442

Cited by

Blog
In the post
Date
lazutkin.com
The cost of dependencies Read at the source ↗
29 Sept 2026
Andrew Nesbitt | Software Engineer and Package Management Nerd
Package Manager Sandboxing Read at the source ↗
24 Sept 2026
connorontheweb.com
Escalating an npm Account Lockout When Support Goes Dark Read at the source ↗
4 Aug 2026
connorontheweb.com
The Case for Vanilla JavaScript in 2026 Read at the source ↗
2 Aug 2026
blog.logrocket.com
Why npm dependencies are a bigger security risk than your code Read at the source ↗
30 Jun 2026
blog.ulisesgascon.com
Blocking Install Scripts Is Not a Silver Bullet Read at the source ↗
19 Jun 2026
sauleau.com
airgap - Security for the modern AI age Read at the source ↗
19 Jun 2026
fbritoferreira.com
npm Can't Fix This From the Outside Read at the source ↗
14 Jun 2026
Determinate Systems Blog
Finally, a secure Nixpkgs for the enterprise: an update on Determinate Secure Packages Read at the source ↗
9 Jun 2026
xergioalex.com
Supply chain attacks in the AI era: the state of open source in 2026 Read at the source ↗
29 May 2026
simonroses.com
The Dependency Trap: Supply Chain Risks in AI-Generated Code (Part 4) Read at the source ↗
8 May 2026
netflux.io
Your .env files are under attack Read at the source ↗
5 May 2026
Chainguard Blog
2026: The year of AI-assisted attacks Read at the source ↗
14 Apr 2026
Chainguard Blog
Ship and patch doesn't cut it in the AI era Read at the source ↗
8 Apr 2026
Docker Engineering
Defending Your Software Supply Chain: What Every Engineering Team Should Do Now Read at the source ↗
2 Apr 2026
Gradle Blog
Avoiding the Next Supply Chain Disaster with GitHub and Gradle Read at the source ↗
25 Feb 2026
jpcouture.bearblog.dev
JavaScript Under Siege: The September 2025 Supply Chain Crisis That Should Wake Us All Up Read at the source ↗
2 Oct 2025

Links from this post

Link
Host
https://docs-cortex.paloaltonetworks.com/p/Cortex+CLOUD
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/prisma/cloud
paloaltonetworks.com
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/url-filtering-features/advanced-url-filtering
docs.paloaltonetworks.com
https://docs.paloaltonetworks.com/wildfire
docs.paloaltonetworks.com
https://docs.paloaltonetworks.com/ngfw
docs.paloaltonetworks.com
https://docs.paloaltonetworks.com/advanced-threat-prevention/administration
docs.paloaltonetworks.com
https://start.paloaltonetworks.com/contact-unit42.html
start.paloaltonetworks.com
https://unit42.paloaltonetworks.com/tag/supply-chain/
unit42.paloaltonetworks.com
https://unit42.paloaltonetworks.com/tag/credential-harvesting/
unit42.paloaltonetworks.com
https://unit42.paloaltonetworks.com/tag/phishing/
unit42.paloaltonetworks.com
https://unit42.paloaltonetworks.com/tag/javascript/
unit42.paloaltonetworks.com
https://www.cyberthreatalliance.org/
cyberthreatalliance.org
https://threatvault.paloaltonetworks.com/?q=87042
threatvault.paloaltonetworks.com
https://threatvault.paloaltonetworks.com/?q=87046
threatvault.paloaltonetworks.com
https://threatvault.paloaltonetworks.com/?q=87047
threatvault.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XDR
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/p/XSIAM
docs-cortex.paloaltonetworks.com
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-4.x-Documentation/Malware-protection
docs-cortex.paloaltonetworks.com
https://www.paloaltonetworks.com/blog/cloud-security/npm-supply-chain-attack/
paloaltonetworks.com
https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
stepsecurity.io
https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
wiz.io