the UpGuardian | Lessons from the Shai-Hulud Attack

This month: Our proprietary research, technical breakdown, and the CISO lessons you won't find anywhere else.

On September 14th, 2025, a self-replicating worm dubbed "Shai Hulud" began targeting the npm software supply chain, compromising over 500 packages and stealing sensitive developer credentials for GitHub, AWS, and other cloud services. This incident was a stress test for the entire software supply chain. Its real story isn't just the attack—it's the ripple effect of real-world victims, the technical failures it exploited, and the urgent lessons that aren't being discussed.   This edition of The UpGuardian is dedicated to deconstructing this major cyber event, from our proprietary research on its victims to the high-level takewayas for CISOs and the strategic frameworks needed to build a resilient defense. Identifying Companies Affected by the Shai-Hulud NPM Supply Chain Attack Nothing showcases the widespread "ripple" effect of the Shai-Hulud attack better than examining the companies and services directly affected by the worm. In our latest research report, we detail our findings on the real-world victims, from the specific developer credentials stolen to the private data exfiltrated and exposed in public GitHub repositories. Read the full research → Beware the Sandworm: The Shai-Hulud Attack Explained Understanding the "ripple effect" is the first step; the next is deconstructing the attack itself. Explore exactly "how" the Shai-Hulud attack succeeded, breaking down its mechanics as a self-replicating worm and detailing the techniques it used to steal developer credentials. See the full analysis → Shai-Hulud's True Lesson for CISOs: A Crisis of Communication [The Shai-Hulud attack] proved that our greatest vulnerability isn't a missing patch but the organizational gap between the security teams who write policy and the engineering teams who build products.   The technical failure of a supply chain attack often masks a deeper organizational problem. In this expert insight, UpGuard CISO Phil Ross explores why a security leader's most important role is to effectively translate complex, abstract supply chain threats into tangible business risks for the rest of the organization. Get the CISO's takeaways → Additional Resources What is Cyber Supply Chain Risk Management? The Shai-Hulud incident is a textbook example of Cyber Supply Chain Risk Management (C-SCRM) failure. Get a foundational overview of the C-SCRM discipline, giving you the terminology and framework to have a strategic conversation about this entire class of risk. Learn the C-SCRM framework → What is a Software Bill of Materials (SBOM)?   You can't protect what you can't see. The Shai-Hulud attack exploited hidden dependencies, a problem that a Software Bill of Materials (SBOM) is designed to solve. Learn how this critical tool provides the visibility needed to manage your software supply chain and prevent the next Shai-Hulud. Understand the power of SBOMs → The lessons from Shai-Hulud are clear: understanding supply chain risk is only the first step. Join our upcoming virtual summit, Cyber Risk Posture in Action, to see how security teams turn scattered risk signals into a unified, measurable defense.   UpGuard Inc., 650 Castro Street, Suite 120-387 , Mountain View, CA , 94041, United States +1 888 882 3223 Unsubscribe | Manage Preferences