Update: Nov. 25, 2025 Unit 42 researchers investigated a renewed npm-focused compromise, in a campaign dubbed Shai-Hulud 2.0. This was first reported in early November 2025. The current campaign is significantly wider in scope, affecting tens of thousands of GitHub repositories This includes over 25,000 malicious repositories across about 350 unique users. Notable Differences in November Campaigns Execution during pre-install dramatically widened the area of impact This campaign introduced a far more aggressive fallback mechanism, which could attempt to destroy a user’s home directory New payload files are named setup_bun.js and bun_environment.js Stolen credentials and secrets are exfiltrated to public GitHub repositories with the repository description: “Sha1-Hulud: The Second Coming.”…