Campaigns
Attacks that span many packages and several waves cannot be explained on a single vulnerability page. Each campaign page brings together the waves, affected packages, indicators and a self-check.
Shai-Hulud: the self-spreading worm campaign on npm and PyPISince September 2025, several supply-chain attacks using the Shai-Hulud name, code or techniques have planted malware in npm and PyPI packages; operators may differ.2,111 OSV records · 2,068 affected packages · 8 incident groups