• Source:JND
Add as a preferred

The government has announced a cybersecurity alert about a new malware attack titled Shai Hulud, which is highly dangerous for startups and IT companies. The virus targets the JavaScript Node Package Manager (npm) ecosystem exclusively, which is most commonly used by developers across the globe for open-source software projects.

ALSO READ: Apple Secretly Testing ChatGPT-Like Siri Upgrade With Internal App ‘Veritas’

What is the Shai Hulud Malware?

Named after a beast from Frank Herbert's science fiction epic Dune, Shai Hulud malware hacks into npm packages and propagates malicious code to spread through development projects. Successfully, it can leak personal user data kept in apps, websites, and online services.

As per CERT-In, attackers employ phishing emails incorporating npm spoofing in order to deceive developers into divulging email passwords and credentials. The malware, once it is inside, can easily propagate, violating sensitive information. Over 500 npm packages have already been infected, and fears of a larger outbreak are being raised.

Why Startups and IT Companies Are at Risk

As startup and IT companies are highly dependent on open-source npm libraries, a single hack could render their platforms inoperable. This may result in data pilferage, service downtime, and long-term reputational loss.

ALSO READ: Apple Dominates Refurbished Smartphone Market In India With 62.9% Share In First Half Of 2025

CERT-In's Recommended Protection

To minimise the risk, CERT-In has asked organisations not to delay. Most important measures are:

  • Vulnerability scanning of all software systems.
  • Rotating developer credentials like passwords.
  • Using phishing-resistant MFA to guard logins.
  • Removing GitHub apps that are unverified or unnecessary.
  • Keeping firewalls under strict monitoring for irregular activity.
  • Repairing problems immediately in case of any irregularity being noticed.

Startups and IT companies are recommended to implement these measures promptly in order to escape the clutches of this malware campaign.