Tracking: Incident report
Severity: Supply-chain incident; no single CVSS score applies
Who is affected
The reported September 2025 campaign includes ngx-bootstrap 18.1.4, 19.0.3, and 20.0.4 through 20.0.6, alongside other packages in the incident report. This list is not a complete inventory of the wider campaign.
How the attack works
Malicious lifecycle code runs during package installation, searching developer and CI environments for npm, GitHub, cloud, and other secrets. Stolen maintainer and automation credentials can then support further repository or package changes.
The key exposure is executing the malicious release, including through a transitive dependency or reused cache. Removal from the registry does not clean an already affected runner or invalidate stolen tokens.
What to do
- Compare lockfiles, installation logs, and caches with the incident's affected-package list. Stop use of malicious artifacts and preserve evidence.
- Rebuild affected developer and CI environments from clean sources. Rotate accessible credentials from a clean system and invalidate old tokens.
- Audit source-control changes, workflow definitions, package ownership, publishing activity, and downstream releases for unauthorized modifications.
Scope and limits
This advisory describes the cited 2025 incident. It should not imply that the listed versions define every later campaign using the Shai-Hulud name.