Threat Talks · 2025-11-25 · 18 min
The world’s biggest open-source ecosystem - npm - faced its first self-spreading worm. They called it Shai Hulud. It didn’t just infect one package. It infected developers themselves. When a maintainer got phished, the worm harvested credentials, hijacked tokens, and created new CI/CD workflows to keep spreading - automatically . No command-and-control. No manual uploads. Just a chain reaction across the npm registry. And while the world was busy shouting about “2.6 billion downloads affected,” this real threat was quietly exfiltrating GitHub, cloud, and npm secrets - right under everyone’s nose. This isn’t just another npm story. It’s the first-ever self-replicating supply chain worm - and a wake-up call for every developer and security team building in the open. Watch host Rob Maas (Field CTO, ON2IT) and Yuri Wit (SOC Analyst, ON2IT) break down how it started, how it spread, and how to make sure your pipeline isn’t the next one to go viral.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
Why Do You Trust Your AI Agent?61 / 100
Mythos is not the AI Apocalypse80 / 100
What about Iran? One Word Document, Three Backdoors76 / 100
Europe Is Losing the Sea Cable Race76 / 100
Russia Cutting Cables?87 / 100
