erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: September 15, 2025

1 editorial brief and 8 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Shai-Hulud. Anyone whose developer machines or CI installed an affected package version between Sep 14 and Sep 16, 2025, and any org with a shai-hulud branch, shai-hulud-workflow.yml file or public Shai-Hulud repository.
  • npm: 4 critical advisories (flowise). Check with npm audit (or: npm ls <package>).
  • Go: 3 critical advisories (github.com/chaos-mesh/chaos-mesh). Check with govulncheck ./....
  • PyPI: 1 critical advisory (mcp-kubernetes-server). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Malicious package

Shai-Hulud: Self-Replicating Worm Hits 500+ npm Packages

The worm's packages were removed in September 2025, but every machine that installed one handed over its npm, GitHub and cloud credentials, so the open question is whether you rotated them and removed the backdoor workflow.

Must act: Anyone whose developer machines or CI installed an affected package version between Sep 14 and Sep 16, 2025, and any org with a shai-hulud branch, shai-hulud-workflow.yml file or public Shai-Hulud repository.

Can relax: Teams whose lockfiles and caches contain none of the affected versions and whose GitHub orgs show no Shai-Hulud artifacts; Windows-only installs were skipped by the payload.

  1. Check lockfiles and caches against a published affected-package list (e.g. npm ls @ctrl/tinycolor) including nested dependencies.
  2. Search every GitHub org for a shai-hulud branch, .github/workflows/shai-hulud-workflow.yml and public repositories named Shai-Hulud; delete them after preserving evidence.
  3. On any machine that installed an affected version, rotate npm tokens, GitHub PATs, SSH keys, AWS/GCP/Azure credentials and CI secrets.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 8

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 4

Check: npm audit (or: npm ls <package>)

Go 3

Check: govulncheck ./...

PyPI 1

Check: pip-audit (or: pip show <package>)