On 2025-11-24, a security write-up described the return of the Shai-Hulud campaign, saying more than 1,000 NPM packages were infected in a fast-moving supply-chain attack.
The report from HelixGuard says the attacker used the same basic method as a previous wave, but scaled it up. According to the excerpt, malicious code was delivered through a fake Bun runtime, and the attacker used the `preinstall` script to download and execute a payload that stole sensitive information from compromised machines. In other words, the attack did not rely on convincing users to click anything. It used package installation itself as the entry point.
That detail is what makes supply-chain incidents so dangerous. Developers trust package managers to retrieve legitimate dependencies, and once one popular package is compromised the infection can spread through downstream installs very quickly. If the HelixGuard account is accurate, the attack was designed for speed, scale, and stealth.
The report also says the compromise touched more than 27,000 GitHub repositories. That number is large enough to show how far a package-based campaign can reach if a malicious dependency gets embedded in everyday development workflows. Even one infected package can become a delivery system for many others.
The excerpt does not give a full incident timeline, list impacted packages, or explain whether all infected repositories were actively compromised or merely exposed to the malicious dependency. Those distinctions matter, but they are not provided here. So the safest reading is the one the source itself supports: a wide malicious package campaign was underway, and the scale was substantial.
The use of a fake Bun runtime is also notable because it suggests the attacker tried to disguise the malicious download as a normal developer tool. That kind of deception works because modern build chains are complex. Anything that looks like a utility or installer can hide a second purpose if reviewers are not paying close attention.
For teams that rely on NPM, the implications are obvious. Package monitoring, script review, and dependency hygiene are not optional niceties. They are the difference between a normal install and the execution of code that may exfiltrate secrets from developer machines or CI systems.
Security incidents like this are difficult to contain because they exploit trust built into the software ecosystem itself. That is why the report's warning matters even beyond the headline numbers. It is not just a story about one package cluster; it is a reminder that the routine act of installing dependencies can become an attack vector when the ecosystem is targeted.
The core facts from the excerpt are stark enough on their own. More than 1,000 NPM packages, a fake Bun runtime, preinstall execution, and stolen sensitive information. That is a supply-chain story with reach well beyond one repository or one team.
