Shai-Hulud npm Worm Used LLM to Generate Malicious Scripts
Date: 2025-09
Affected: npm Ecosystem (Crowdstrike, Postman, Zapier packages)
Attack vector: supply-chain
Category: real-world
Severity: Critical

Unit 42 assessed Shai-Hulud npm supply chain worm campaign used LLM to generate malicious scripts that compromised hundreds of packages including Crowdstrike, Postman, and Zapier.


Mitigations:

Architectural layers (MAESTRO):