Open Source · · 1 day

Zapier npm packages hit by Shai-Hulud

The Sha1-Hulud "Second Coming" npm worm compromised Zapier packages across the @zapier scope and unscoped zapier-platform packages.

Part of Sha1-Hulud worm spread across npm packages campaign

Zapier disclosed unauthorized modifications to a subset of its npm packages on November 24, 2025. The affected packages were developer tooling for Zapier platform integrations, not the Zapier product runtime, and Zapier said it had no indication of customer data loss.

The compromise lined up with the Sha1-Hulud "Second Coming" wave. Malicious npm releases installed a Bun-based payload that harvested secrets, wrote stolen data into attacker-created GitHub repositories, and tried to spread by abusing npm tokens and GitHub trusted-publishing paths.

Zapier unpublished the core platform packages by 10:30 UTC and deprecated the rest by 14:03 UTC. Its guidance was direct: do not install the affected versions, clean npm caches and local node_modules, reinstall current packages, and rotate secrets if compromised packages were used to publish integrations.

This record keeps Zapier as its own attack because the package scope is specific and officially enumerated. The broader worm remains modeled as the parent campaign.

Appendix · Affected releases

@zapier/stubtree npm
0.1.2 sha256 ce444992…a549b4b9 download unavailable
0.1.3 sha256 0fcd5db3…234cd818 download unavailable
0.1.4 sha256 1802d5af…21a0be57 download unavailable
redux-router-kit npm
1.2.2 sha256 0e5a47ac…b912b7fe download unavailable
1.2.3 sha256 aad26619…01f75b90 download unavailable
1.2.4 sha256 9f03652b…e3a5444e download unavailable
zapier-scripts npm
7.8.3 sha256 83dffd02…47bcfffd download unavailable
7.8.4 sha256 ad919d55…b1016bd6 download unavailable

Indicators

  • file_sha256bun_environment.js 62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0
  • file_sha256bun_environment.js f099c5d9ec417d4445a0328ac0ada9cde79fc37410914103ae9c609cbc0ee068
  • file_sha256bun_environment.js cbb9bc5a8496243e02f3cc080efbe3e4a1430ba0671f2e43a202bf45b05479cd
  • file_sha256setup_bun.js a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a

References

  1. "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack - Unit 42unit42.paloaltonetworks.com
  2. Unauthorized Access to Zapier NPM Packagesdocs.zapier.com
  3. Zapier's NPM Account Compromised in Supply Chain Attackcybersecuritynews.com
  4. Sha1-Hulud the Second Comingstepsecurity.io
  5. Sha1-Hulud the Second Coming Affected Package Liststepsecurity-public-media.s3.us-west-2.amazonaws.com
  6. jsDelivr retained file manifest for @zapier/ai-actions 0.1.18data.jsdelivr.com
  7. Socket retained file manifest for @zapier/ai-actions 0.1.18socket.dev
  8. jsDelivr retained file manifest for @zapier/ai-actions 0.1.19data.jsdelivr.com
  9. Socket retained file manifest for @zapier/ai-actions 0.1.19socket.dev
  10. jsDelivr retained file manifest for @zapier/ai-actions 0.1.20data.jsdelivr.com
  11. Socket retained file manifest for @zapier/ai-actions 0.1.20socket.dev
  12. jsDelivr retained file manifest for @zapier/ai-actions-react 0.1.12data.jsdelivr.com
  13. Socket retained file manifest for @zapier/ai-actions-react 0.1.12socket.dev
  14. jsDelivr retained file manifest for @zapier/ai-actions-react 0.1.13data.jsdelivr.com
  15. Socket retained file manifest for @zapier/ai-actions-react 0.1.13socket.dev
  16. jsDelivr retained file manifest for @zapier/ai-actions-react 0.1.14data.jsdelivr.com
  17. Socket retained file manifest for @zapier/ai-actions-react 0.1.14socket.dev
  18. jsDelivr retained file manifest for @zapier/babel-preset-zapier 6.4.1data.jsdelivr.com
  19. Socket retained file manifest for @zapier/babel-preset-zapier 6.4.1socket.dev
  20. jsDelivr retained file manifest for @zapier/babel-preset-zapier 6.4.2data.jsdelivr.com
  21. Socket retained file manifest for @zapier/babel-preset-zapier 6.4.2socket.dev
  22. jsDelivr retained file manifest for @zapier/babel-preset-zapier 6.4.3data.jsdelivr.com
  23. Socket retained file manifest for @zapier/babel-preset-zapier 6.4.3socket.dev
  24. Socket hash-addressed package.json for @zapier/babel-preset-zapier 6.4.1socketusercontent.com
  25. Socket hash-addressed package.json for @zapier/babel-preset-zapier 6.4.2socketusercontent.com
  26. Socket hash-addressed package.json for @zapier/babel-preset-zapier 6.4.3socketusercontent.com
  27. jsDelivr retained file manifest for @zapier/browserslist-config-zapier 1.0.3data.jsdelivr.com
  28. Socket retained file manifest for @zapier/browserslist-config-zapier 1.0.3socket.dev
  29. Socket hash-addressed package.json for @zapier/browserslist-config-zapier 1.0.3socketusercontent.com
  30. jsDelivr retained file manifest for @zapier/browserslist-config-zapier 1.0.4data.jsdelivr.com
  31. Socket retained file manifest for @zapier/browserslist-config-zapier 1.0.4socket.dev
  32. Socket hash-addressed package.json for @zapier/browserslist-config-zapier 1.0.4socketusercontent.com
  33. jsDelivr retained file manifest for @zapier/browserslist-config-zapier 1.0.5data.jsdelivr.com
  34. Socket retained file manifest for @zapier/browserslist-config-zapier 1.0.5socket.dev
  35. Socket hash-addressed package.json for @zapier/browserslist-config-zapier 1.0.5socketusercontent.com
  36. jsDelivr retained file manifest for @zapier/eslint-plugin-zapier 11.0.3data.jsdelivr.com
  37. Socket retained file manifest for @zapier/eslint-plugin-zapier 11.0.3socket.dev
  38. Socket hash-addressed package.json for @zapier/eslint-plugin-zapier 11.0.3socketusercontent.com
  39. jsDelivr retained file manifest for @zapier/eslint-plugin-zapier 11.0.4data.jsdelivr.com
  40. Socket retained file manifest for @zapier/eslint-plugin-zapier 11.0.4socket.dev
  41. Socket hash-addressed package.json for @zapier/eslint-plugin-zapier 11.0.4socketusercontent.com
  42. jsDelivr retained file manifest for @zapier/eslint-plugin-zapier 11.0.5data.jsdelivr.com
  43. Socket retained file manifest for @zapier/eslint-plugin-zapier 11.0.5socket.dev
  44. Socket hash-addressed package.json for @zapier/eslint-plugin-zapier 11.0.5socketusercontent.com
  45. jsDelivr retained file manifest for @zapier/mcp-integration 3.0.1data.jsdelivr.com
  46. Socket retained file manifest for @zapier/mcp-integration 3.0.1socket.dev
  47. Socket hash-addressed package.json for @zapier/mcp-integration 3.0.1socketusercontent.com
  48. jsDelivr retained file manifest for @zapier/mcp-integration 3.0.2data.jsdelivr.com
  49. Socket retained file manifest for @zapier/mcp-integration 3.0.2socket.dev
  50. Socket hash-addressed package.json for @zapier/mcp-integration 3.0.2socketusercontent.com
  51. jsDelivr retained file manifest for @zapier/mcp-integration 3.0.3data.jsdelivr.com
  52. Socket retained file manifest for @zapier/mcp-integration 3.0.3socket.dev
  53. Socket hash-addressed package.json for @zapier/mcp-integration 3.0.3socketusercontent.com
  54. jsDelivr retained file manifest for zapier-platform-cli 18.0.2data.jsdelivr.com
  55. Socket retained file manifest for zapier-platform-cli 18.0.2socket.dev
  56. Socket hash-addressed package.json for zapier-platform-cli 18.0.2socketusercontent.com
  57. jsDelivr retained file manifest for zapier-platform-cli 18.0.3data.jsdelivr.com
  58. Socket retained file manifest for zapier-platform-cli 18.0.3socket.dev
  59. Socket hash-addressed package.json for zapier-platform-cli 18.0.3socketusercontent.com
  60. jsDelivr retained file manifest for zapier-platform-cli 18.0.4data.jsdelivr.com
  61. Socket retained file manifest for zapier-platform-cli 18.0.4socket.dev
  62. Socket hash-addressed package.json for zapier-platform-cli 18.0.4socketusercontent.com
  63. jsDelivr retained file manifest for zapier-platform-core 18.0.2data.jsdelivr.com
  64. Socket retained file manifest for zapier-platform-core 18.0.2socket.dev
  65. Socket hash-addressed package.json for zapier-platform-core 18.0.2socketusercontent.com
  66. jsDelivr retained file manifest for zapier-platform-core 18.0.3data.jsdelivr.com
  67. Socket retained file manifest for zapier-platform-core 18.0.3socket.dev
  68. Socket hash-addressed package.json for zapier-platform-core 18.0.3socketusercontent.com
  69. jsDelivr retained file manifest for zapier-platform-core 18.0.4data.jsdelivr.com
  70. Socket retained file manifest for zapier-platform-core 18.0.4socket.dev
  71. Socket hash-addressed package.json for zapier-platform-core 18.0.4socketusercontent.com

Source record: oss/attacks/zapier-npm/meta.yaml