Self-replicating worm reveals vulnerabilities in open-source cryptocurrency security

Bitget App

Trade smarter

Bitget

News

Markets

Self-replicating worm reveals vulnerabilities in open-source cryptocurrency security

Bitget-RWA2025/11/24 15:04

By:Bitget-RWA

- Aikido Security discovered a self-replicating worm called Shai Hulud infecting 400+ npm packages, including critical crypto tools like ENS-related libraries. - The malware autonomously steals credentials from 25,000+ repositories, with one infected package having 1.5 million weekly downloads. - Security experts urge immediate mitigation: clear npm caches, rotate credentials, and revoke classic tokens by December 9. - The attack exposes systemic vulnerabilities in open-source ecosystems, threatening both

An extensive JavaScript supply-chain attack has compromised hundreds of software packages, including at least 10 that are heavily relied upon in the cryptocurrency sector,

based on findings from cybersecurity company Aikido Security

. This campaign, named "Shai Hulud," utilizes a self-propagating worm to infect npm packages and extract credentials, which may include sensitive crypto wallet information.

Aikido Security researcher Charlie Eriksen discovered

more than 400 packages exhibiting evidence of infection, many of which are associated with the

Ethereum Name Service

(ENS), a vital service for user-friendly crypto addresses.

This malicious software autonomously spreads through developer environments, collecting confidential data and uploading it to the affected users' GitHub repositories.

According to Wiz researchers, over 25,000 repositories

were breached within just three days of the most recent attack, with new infections occurring at a pace of 1,000 every half hour.

This incident builds upon a security breach from September 2025

that resulted in $50 million in crypto theft, but Shai Hulud is more expansive, aiming at general credentials rather than directly targeting digital assets.

Self-replicating worm reveals vulnerabilities in open-source cryptocurrency security image 0

Some of the impacted packages include ENS-related utilities like `ensjs` (over 30,000 downloads per week), `ethereum-ens` (more than 12,650 downloads), and `ens-contracts` (over 3,100 downloads), along with non-crypto packages from services such as Zapier.

The magnitude of this compromise is significant

: a single infected package was downloaded upwards of 1.5 million times each week.

Aikido Security cautioned

that unless developers act swiftly, the attack could lead to exposure of private repositories and further proliferation.

Experts in cybersecurity stress the need for immediate countermeasures.

Wiz advised developers to clear npm caches

, revert to versions prior to November 21, and update all credentials. GitHub is in the process of removing compromised repositories, but the worm's rapid distribution complicates remediation.

The npm registry has also stated

that all classic tokens will be invalidated by December 9 as a security measure.

This incident exposes the risks inherent in open-source software, where a single tainted package can jeopardize thousands of dependent projects.

Eriksen from Aikido Security remarked

that the "scale is truly enormous," affecting not only crypto infrastructure but the wider software development landscape as well.

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops

Lock your assets and earn 10%+ APR

Lock now!

- Crypto markets face selling pressure amid macroeconomic uncertainty, with Solana (SOL) slipping below key levels despite ETF inflows. - Emerging altcoins like Apeing ($APEING) leverage whitelist programs to attract early adopters, promising high-conviction growth potential. - Institutional buybacks ($50M by Upexi , $10M by Antalpha) signal confidence in long-term crypto value despite short-term volatility. - Grayscale warns Q4 risks persist despite staking ETF optimism , as AI-driven trading experiments

Bitget-RWA•2025/11/25 03:00

South Korea's 'First-In, First-Out' Approach to Crypto Intensifies AML Enforcement

- South Korea's FIU intensifies crypto AML enforcement, sanctioning exchanges like Upbit, Korbit, and Bithumb for compliance failures. - A "first-in, first-out" penalty model targets inspected exchanges sequentially, with Dunamu fined $24.35M and operational restrictions in November 2025. - Fines could reach tens of billions of won per platform, aiming to standardize global AML standards while delaying a crypto tax regime until 2027. - The crackdown faces mixed reactions, balancing stricter oversight with

Bitget-RWA•2025/11/25 03:00

South Korea's 'First-In, First-Out' Approach to Crypto Intensifies AML Enforcement

Bitcoin Updates Today: As Bitcoin Falters, AI Partnerships Highlight Changing Market Focus

- Bitcoin's 25% monthly drop tests $80,553 support as 11 U.S. ETFs report $3.79B outflows amid heightened gamma-driven selling and thinning liquidity. - Binance's Richard Teng frames volatility as "healthy consolidation," noting crypto's 100%+ 2024 gains despite macro risks and uncertain Fed policy. - Market makers face amplified swings below $85,000 due to short-gamma positions, while Deutsche Bank links selloff to regulatory stagnation and profit-taking. - Bitcoin Munari's $0.10 token presale and C3.ai's

Bitget-RWA•2025/11/25 03:00

Bitcoin Updates Today: As Bitcoin Falters, AI Partnerships Highlight Changing Market Focus

Ethereum News Update: Ethereum Faces $2,900 Test as $531 Million in Liquidations Threaten $10,000 Ambitions

- Ethereum faces $2,900-$2,700 volatility threshold, with $531M short liquidation risk above and $988M long liquidation risk below. - Bearish momentum intensifies as Binance outflows and $350M daily liquidations accelerate downward pressure below $2,800 support. - Long-term forecasts project $10,000 by 2030 driven by Ethereum 2.0 upgrades, deflationary mechanics, and institutional adoption like BitMine's $11.2B ETH stake. - Aztec's decentralized L2 launch and GENIUS Act regulatory proposals highlight Ether

Bitget-RWA•2025/11/25 02:46